Alert Triage Worker

The Alert Triage Worker is part of the Triage Watch. It classifies detection alerts as true or false positives and proposes closing the false positives, so your analysts see only the alerts that need them. This page explains when to use the Alert Triage Worker, what data it needs, how it triages alerts, where to decide its proposed actions, and which settings control the alerts it triages.

The Alert Triage Worker is the right fit when:

• Your analysts spend much of their time closing alerts that turn out to be false positives.
• You want the Attack Discovery Worker to build candidate attacks from fewer, more meaningful alerts.
• You want the Rule Tuning Worker to have a steady supply of false positive closures to find noisy rules from.

The Alert Triage Worker isn't the best fit when:

• A few rules cause most of your false positives. Fixing those rules stops the alerts at the source. Use the Rule Tuning Worker instead, or alongside it.
• You want a person to approve every alert closure. You can still use the Alert Triage Worker, but keep it at Manual so you approve each one.

The Alert Triage Worker needs detection alerts in the space with a status of open or acknowledged. It includes building block alerts unless you turn on Exclude building-block alerts.

On each run, the Alert Triage Worker:

1. Analyzes open and acknowledged alerts in batches.
2. Tags each alert as a true positive, false positive, or inconclusive, and adds a note explaining why.
3. Groups alerts with the same pattern into one investigation and one proposed action.
4. Proposes closing the alerts it's confident are false positives.

When the Alert Triage Worker closes an alert as a false positive, the alert drops out of your analysts' open alerts, and the Attack Discovery Worker skips it, because that Worker analyzes only open and acknowledged alerts. The Rule Tuning Worker counts these closures when it looks for rules to tune.

You review the Alert Triage Worker's proposed actions in the Investigate section of the Proposed actions page. To learn how to review a proposed closure and then approve or decline it, refer to Decide a proposed action.

A vulnerability scanner on your network triggers a port scan rule 40 times overnight. The Alert Triage Worker analyzes the alerts, tags each one as a false positive with a note explaining that the activity comes from the scanner, and groups them into one investigation with one proposed action to close them. At Manual, you approve that one closure instead of closing 40 alerts by hand. After the Alert Triage Worker closes them, the Attack Discovery Worker skips them, and the Rule Tuning Worker counts them toward the port scan rule's false positives.

Schedule

How often the Alert Triage Worker runs.

Default: Every 15 minutes

Autonomy

How much the Alert Triage Worker does without you. You can set it to Manual or Supervised. Refer to what it does at each level.

Default: Manual

Models

Opens Feature settings, where you select the models that AlertZero uses in the space. The Alert Triage Worker has no model setting of its own, so it uses the models you select there.

Minimum confidence score

How confident it must be that an alert is a false positive before it proposes closing the alert. If its confidence is lower, it tags the alert inconclusive.

Default: 85%, and you can set it to any whole number from 0 to 100.

Minimum severity

The lowest alert severity it triages. You can select Low, Medium, High, or Critical.

Default: Low, which triages every alert.

Exclude building block alerts

Skips alerts from building block rules.

Default: Off

Excluded rule tags

Skips alerts from rules with any of these tags. Tags must match exactly, including case.

Default: None, you can add up to 50 tags.