--- title: AlertZero glossary description: Reference of terms used across AlertZero documentation, with links to the pages that explain them. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/glossary products: - Elastic Cloud Serverless - Elastic Documentation - Elastic Security applies_to: - Serverless Security projects: Preview - Elastic Stack: Planned --- # AlertZero glossary This glossary defines the terms you see in AlertZero and its documentation. Each entry links to the page that explains it in more detail, where one exists. ## A-B ### AlertZero The agentic layer of Elastic Security. AI-powered [Workers](#alertzero-glossary-worker), grouped into [Watches](#alertzero-glossary-watch), triage alerts, hunt for threats, tune detection rules, and investigate attacks, then bring you the [proposed actions](#alertzero-glossary-proposed-action) that need a person to decide. Refer to [AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero). ### Assisted (autonomy) An [autonomy](#alertzero-glossary-autonomy) level at which a Worker starts its analysis on its own, without asking you first, but makes no change until you approve it. For example, Rule Tuning analyzes a noisy rule on its own and drafts a tuning change, and then you decide whether to apply it. Refer to [Configure Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings). ### Attack Discovery An Elastic Security feature that uses large language models (LLMs) to group related alerts into attack narratives. In AlertZero, Attack Discovery is also the name of a [Worker](#alertzero-glossary-worker) in the [Triage Watch](#alertzero-glossary-triage-watch). It runs on a schedule, opens an [investigation](#alertzero-glossary-investigation) for each candidate attack, and proposes handing attacks it confirms, or can't rule out, to the [Forensics Watch](#alertzero-glossary-forensics-watch). Refer to [Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/ai/attack-discovery) and [Attack Discovery Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker). ### Autonomy A Worker setting that controls how far the Worker goes on its own before it waits for a person. Each Worker offers some of these levels: [**Manual**](#alertzero-glossary-manual), [**Assisted**](#alertzero-glossary-assisted), and [**Supervised**](#alertzero-glossary-supervised). Every Worker starts at **Manual**. Refer to [Configure Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings). ### Balanced models A model setting in **Feature Settings** for AlertZero calls where accuracy matters, but that run often or use tools over many steps, such as triaging alerts or diagnosing a noisy rule. Select a strong mid-size model. Refer to [Efficient models](#alertzero-glossary-efficient-models) and [Frontier models](#alertzero-glossary-frontier-models). ## C-D ### Cyber domain models An optional model setting in **Feature Settings** for cyber-specific models. A model you save here replaces the [Efficient](#alertzero-glossary-efficient-models) or [Frontier](#alertzero-glossary-frontier-models) model that Attack Discovery and alert triage calls would otherwise use. If you leave it empty, those calls keep using their usual models. ### Detection Watch The [Watch](#alertzero-glossary-watch) that handles detection engineering, improving your detection rules at the source instead of handling the alerts they produce one by one. Its Rule Tuning Worker diagnoses rules that produce too many false positives and proposes tuning changes. Its Rule Coverage Worker assesses detection gaps that the Hunt Watch finds and proposes new or existing rules to close them. Refer to [Detection Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/detection-watch). ## E-F ### Efficient models A model setting in **Feature Settings** for AlertZero calls that need quick, lightweight judgment and run often, such as checking detection coverage. Select a small, low-cost model. Refer to [Balanced models](#alertzero-glossary-balanced-models) and [Frontier models](#alertzero-glossary-frontier-models). ### Escalation A coordinated response that you create from an [investigation](#alertzero-glossary-investigation) to work on it with other people, privately if needed. An escalation can link related investigations, and it has an owner, assignees, and a visibility of **Public** or **Private**. Closing an escalation also closes its linked investigations. Refer to [Escalate an investigation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/escalate-investigation) and [Track escalations](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/track-escalations). ### Forensics Watch The [Watch](#alertzero-glossary-watch) that does deep research on threats and exploits, running forensics on an attack. Its Endpoint Analysis Worker reconstructs the attack timeline on one affected host and proposes response actions. It runs only on attacks handed off by the Attack Discovery Worker, and it needs Elastic Defend data. Refer to [Forensics Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/forensics-watch). ### Frontier models A model setting in **Feature Settings** for complex, single-pass AlertZero work where output quality matters most, such as generating attack discoveries or drafting a detection rule. Select your most capable model. Refer to [Efficient models](#alertzero-glossary-efficient-models) and [Balanced models](#alertzero-glossary-balanced-models). ## H-I ### Hunt finding A result from the [Hunt Watch](#alertzero-glossary-hunt-watch) that shows activity in your environment matching a [threat report](#alertzero-glossary-threat-report). Each hunt finding opens an [investigation](#alertzero-glossary-investigation) and shows its supporting evidence, such as matching events, indicators, and techniques. In an investigation, a hunt finding appears as a **Significant Security Event**. Refer to [Act on a hunt finding](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/act-on-hunt-finding). ### Hunt Watch The [Watch](#alertzero-glossary-watch) that proactively hunts your environment for threats, without waiting for an alert. Its Continuous Threat Hunt Worker searches your data for activity that matches threat reports and for detection coverage gaps. This Worker runs on a fixed schedule and always uses [**Manual**](#alertzero-glossary-manual) autonomy. Refer to [Hunt Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/hunt-watch). ### Investigation A record of an AlertZero Worker's inquiry into a potential threat, such as a candidate attack or a [hunt finding](#alertzero-glossary-hunt-finding). An investigation collects the Worker's evidence, its conclusion, and any [proposed actions](#alertzero-glossary-proposed-action). You can assign an investigation, close it, or [escalate](#alertzero-glossary-escalation) it. Refer to [Escalate an investigation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/escalate-investigation). ## M-P ### Manual (autonomy) The default [autonomy](#alertzero-glossary-autonomy) level. At this level, you approve every action the Worker proposes, and some Workers also ask you before they start analyzing. For example, you approve each false-positive alert that Alert Triage closes, each attack that Attack Discovery hands to the Forensics Watch, and each response action that Endpoint Analysis runs. Refer to [Configure Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings). ### Proposed action A recommendation from a Worker that waits for your decision, such as closing false-positive alerts, isolating a host, or changing a detection rule. You review the details, then approve or decline it. Depending on the Worker's [autonomy](#alertzero-glossary-autonomy) level, some proposed actions run without waiting for you. Statuses include **Needs review**, **Approved**, **Applying**, **Applied**, **Declined**, **Failed**, and **Expired**. Refer to [Use AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/use-alertzero). ## R-S ### Supervised (autonomy) The highest [autonomy](#alertzero-glossary-autonomy) level. At this level, the Worker approves its own proposed actions instead of waiting for you, and you review the results afterward. For example, Alert Triage closes false-positive alerts, which you can reopen, Attack Discovery hands attacks to the Forensics Watch, and Endpoint Analysis runs its response actions. Refer to [Configure Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings). ## T-W ### Threat intel supply The set of workflows that feed threat intelligence to the [Hunt Watch](#alertzero-glossary-hunt-watch). **Ingest threat feeds** brings in threat intelligence feeds, **Enrich threat report** builds out threat reports, and **Attribute alerts to reports** connects alerts to those reports. AlertZero turns them on when you turn on the Continuous Threat Hunt Worker, and off again when you turn it off. All spaces share **Ingest threat feeds** and **Enrich threat report**. Refer to [Configure Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings). ### Threat report A report of threat activity, built from ingested threat intelligence, that the [Hunt Watch](#alertzero-glossary-hunt-watch) searches your data for. A [hunt finding](#alertzero-glossary-hunt-finding) links back to its source report. ### Triage Watch The [Watch](#alertzero-glossary-watch) that works as your first line of defense, reviewing incoming alerts and routing the ones that still need a person. Its Alert Triage Worker classifies alerts as true or false positives, then proposes closing the false positives. Its Attack Discovery Worker finds candidate attacks and opens an investigation for each. Refer to [Triage Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/triage-watch). ### Watch A named group of [Workers](#alertzero-glossary-worker) with one area of expertise. AlertZero includes the following Watches: [Triage Watch](#alertzero-glossary-triage-watch), [Hunt Watch](#alertzero-glossary-hunt-watch), [Detection Watch](#alertzero-glossary-detection-watch), and [Forensics Watch](#alertzero-glossary-forensics-watch). Each Watch has its own page where you turn its Workers on or off and change their settings. Refer to [Configure Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings). ### Worker An AI-powered unit of work that belongs to a [Watch](#alertzero-glossary-watch). A Worker runs in the background, either on a schedule or when another Worker hands it work. It analyzes your data and brings you [proposed actions](#alertzero-glossary-proposed-action). Each Worker has its own settings, including whether it's turned on, its trigger, and its [autonomy](#alertzero-glossary-autonomy) level. Refer to [Configure Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings). ## Related - [AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero): What AlertZero is and how its parts fit together. - [Configure Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings): What each Watch and Worker does, and how to change their settings. - [Use AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/use-alertzero): Read the AlertZero home page and decide on proposed actions. - [Manage AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/manage-alertzero): What you can and can't configure in AlertZero.