---
title: Alert Triage Worker
description: Find what the AlertZero Alert Triage Worker does in Elastic Security, and the settings that control which alerts it triages and closes.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/alert-triage-worker
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Alert Triage Worker
The Alert Triage Worker is part of the [Triage Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/triage-watch). It classifies detection alerts as true or false positives and proposes closing the false positives, so your analysts see only the alerts that need them. This page explains when to use the Alert Triage Worker, what data it needs, how it triages alerts, where to decide its proposed actions, and which settings control the alerts it triages.

## When to use the Alert Triage Worker

The Alert Triage Worker is the right fit when:
- Your analysts spend much of their time closing alerts that turn out to be false positives.
- You want the [Attack Discovery Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker) to build candidate attacks from fewer, more meaningful alerts.
- You want the [Rule Tuning Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-tuning-worker) to have a steady supply of false positive closures to find noisy rules from.

The Alert Triage Worker isn't the best fit when:
- A few rules cause most of your false positives. Fixing those rules stops the alerts at the source. Use the [Rule Tuning Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-tuning-worker) instead, or alongside it.
- You want a person to approve every alert closure. You can still use the Alert Triage Worker, but keep it at **Manual** so you approve each one.


## Data requirements

The Alert Triage Worker needs detection alerts in the space with a status of open or acknowledged. It includes building block alerts unless you turn on **Exclude building-block alerts**.

## How it works

On each run, the Alert Triage Worker:
1. Analyzes open and acknowledged alerts in batches.
2. Tags each alert as a true positive, false positive, or inconclusive, and adds a note explaining why.
3. Groups alerts with the same pattern into one investigation and one proposed action.
4. Proposes closing the alerts it's confident are false positives.

When the Alert Triage Worker closes an alert as a false positive, the alert drops out of your analysts' open alerts, and the [Attack Discovery Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker) skips it, because that Worker analyzes only open and acknowledged alerts. The [Rule Tuning Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-tuning-worker) counts these closures when it looks for rules to tune.
You review the Alert Triage Worker's proposed actions in the **Investigate** section of the **Proposed actions** page. To learn how to review a proposed closure and then approve or decline it, refer to [Decide a proposed action](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/decide-proposed-action).

### Example

A vulnerability scanner on your network triggers a port scan rule 40 times overnight. The Alert Triage Worker analyzes the alerts, tags each one as a false positive with a note explaining that the activity comes from the scanner, and groups them into one investigation with one proposed action to close them. At **Manual**, you approve that one closure instead of closing 40 alerts by hand. After the Alert Triage Worker closes them, the Attack Discovery Worker skips them, and the Rule Tuning Worker counts them toward the port scan rule's false positives.

## Settings

<definitions>
  <definition term="Schedule">
    How often the Alert Triage Worker runs.
    Default: Every 15 minutes
  </definition>
  <definition term="Autonomy">
    How much the Alert Triage Worker does without you. You can set it to **Manual** or **Supervised**. Refer to [what it does at each level](/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings#alertzero-worker-autonomy).
    Default: Manual
  </definition>
  <definition term="Models">
    Opens **Feature settings**, where you select the models that AlertZero uses in the space. The Alert Triage Worker has no model setting of its own, so it uses the models you select there.
  </definition>
</definitions>

<definitions>
  <definition term="Minimum confidence score">
    How confident it must be that an alert is a false positive before it proposes closing the alert. If its confidence is lower, it tags the alert inconclusive.
    Default: 85%, and you can set it to any whole number from 0 to 100.
  </definition>
  <definition term="Minimum severity">
    The lowest alert severity it triages. You can select **Low**, **Medium**, **High**, or **Critical**.
    Default: Low, which triages every alert.
  </definition>
  <definition term="Exclude building block alerts">
    Skips alerts from building block rules.
    Default: Off
  </definition>
  <definition term="Excluded rule tags">
    Skips alerts from rules with any of these tags. Tags must match exactly, including case.
    Default: None, you can add up to 50 tags.
  </definition>
</definitions>