AlertZero glossary

This glossary defines the terms you see in AlertZero and its documentation. Each entry links to the page that explains it in more detail, where one exists.

The agentic layer of Elastic Security. AI-powered Workers, grouped into Watches, triage alerts, hunt for threats, tune detection rules, and investigate attacks, then bring you the proposed actions that need a person to decide. Refer to AlertZero.

An autonomy level at which a Worker starts its analysis on its own, without asking you first, but makes no change until you approve it. For example, Rule Tuning analyzes a noisy rule on its own and drafts a tuning change, and then you decide whether to apply it. Refer to Configure Watches and Workers.

An Elastic Security feature that uses large language models (LLMs) to group related alerts into attack narratives. In AlertZero, Attack Discovery is also the name of a Worker in the Triage Watch. It runs on a schedule, opens an investigation for each candidate attack, and proposes handing attacks it confirms, or can't rule out, to the Forensics Watch. Refer to Attack Discovery and Attack Discovery Worker.

A Worker setting that controls how far the Worker goes on its own before it waits for a person. Each Worker offers some of these levels: Manual, Assisted, and Supervised. Every Worker starts at Manual. Refer to Configure Watches and Workers.

A model setting in Feature Settings for AlertZero calls where accuracy matters, but that run often or use tools over many steps, such as triaging alerts or diagnosing a noisy rule. Select a strong mid-size model. Refer to Efficient models and Frontier models.

An optional model setting in Feature Settings for cyber-specific models. A model you save here replaces the Efficient or Frontier model that Attack Discovery and alert triage calls would otherwise use. If you leave it empty, those calls keep using their usual models.

The Watch that handles detection engineering, improving your detection rules at the source instead of handling the alerts they produce one by one. Its Rule Tuning Worker diagnoses rules that produce too many false positives and proposes tuning changes. Its Rule Coverage Worker assesses detection gaps that the Hunt Watch finds and proposes new or existing rules to close them. Refer to Detection Watch.

A model setting in Feature Settings for AlertZero calls that need quick, lightweight judgment and run often, such as checking detection coverage. Select a small, low-cost model. Refer to Balanced models and Frontier models.

A coordinated response that you create from an investigation to work on it with other people, privately if needed. An escalation can link related investigations, and it has an owner, assignees, and a visibility of Public or Private. Closing an escalation also closes its linked investigations. Refer to Escalate an investigation and Track escalations.

The Watch that does deep research on threats and exploits, running forensics on an attack. Its Endpoint Analysis Worker reconstructs the attack timeline on one affected host and proposes response actions. It runs only on attacks handed off by the Attack Discovery Worker, and it needs Elastic Defend data. Refer to Forensics Watch.

A model setting in Feature Settings for complex, single-pass AlertZero work where output quality matters most, such as generating attack discoveries or drafting a detection rule. Select your most capable model. Refer to Efficient models and Balanced models.

A result from the Hunt Watch that shows activity in your environment matching a threat report. Each hunt finding opens an investigation and shows its supporting evidence, such as matching events, indicators, and techniques. In an investigation, a hunt finding appears as a Significant Security Event. Refer to Act on a hunt finding.

The Watch that proactively hunts your environment for threats, without waiting for an alert. Its Continuous Threat Hunt Worker searches your data for activity that matches threat reports and for detection coverage gaps. This Worker runs on a fixed schedule and always uses Manual autonomy. Refer to Hunt Watch.

A record of an AlertZero Worker's inquiry into a potential threat, such as a candidate attack or a hunt finding. An investigation collects the Worker's evidence, its conclusion, and any proposed actions. You can assign an investigation, close it, or escalate it. Refer to Escalate an investigation.

The default autonomy level. At this level, you approve every action the Worker proposes, and some Workers also ask you before they start analyzing. For example, you approve each false-positive alert that Alert Triage closes, each attack that Attack Discovery hands to the Forensics Watch, and each response action that Endpoint Analysis runs. Refer to Configure Watches and Workers.

A recommendation from a Worker that waits for your decision, such as closing false-positive alerts, isolating a host, or changing a detection rule. You review the details, then approve or decline it. Depending on the Worker's autonomy level, some proposed actions run without waiting for you. Statuses include Needs review, Approved, Applying, Applied, Declined, Failed, and Expired. Refer to Use AlertZero.

The highest autonomy level. At this level, the Worker approves its own proposed actions instead of waiting for you, and you review the results afterward. For example, Alert Triage closes false-positive alerts, which you can reopen, Attack Discovery hands attacks to the Forensics Watch, and Endpoint Analysis runs its response actions. Refer to Configure Watches and Workers.

The set of workflows that feed threat intelligence to the Hunt Watch. Ingest threat feeds brings in threat intelligence feeds, Enrich threat report builds out threat reports, and Attribute alerts to reports connects alerts to those reports. AlertZero turns them on when you turn on the Continuous Threat Hunt Worker, and off again when you turn it off. All spaces share Ingest threat feeds and Enrich threat report. Refer to Configure Watches and Workers.

A report of threat activity, built from ingested threat intelligence, that the Hunt Watch searches your data for. A hunt finding links back to its source report.

The Watch that works as your first line of defense, reviewing incoming alerts and routing the ones that still need a person. Its Alert Triage Worker classifies alerts as true or false positives, then proposes closing the false positives. Its Attack Discovery Worker finds candidate attacks and opens an investigation for each. Refer to Triage Watch.

A named group of Workers with one area of expertise. AlertZero includes the following Watches: Triage Watch, Hunt Watch, Detection Watch, and Forensics Watch. Each Watch has its own page where you turn its Workers on or off and change their settings. Refer to Configure Watches and Workers.

An AI-powered unit of work that belongs to a Watch. A Worker runs in the background, either on a schedule or when another Worker hands it work. It analyzes your data and brings you proposed actions. Each Worker has its own settings, including whether it's turned on, its trigger, and its autonomy level. Refer to Configure Watches and Workers.