Attack Discovery Worker

The Attack Discovery Worker is part of the Triage Watch. It groups related alerts into candidate attacks and checks each one before it reaches you. This page explains when to use the Attack Discovery Worker, what data it needs, how it finds and checks attacks, where to decide its proposed actions, and which limits apply.

The Attack Discovery Worker is the right fit when:

  • You want the Attack Discovery Worker to connect related alerts into attacks, instead of piecing them together yourself.
  • You want the Attack Discovery Worker to check each candidate attack for false positives before it reaches you.
  • You want the Forensics Watch to investigate confirmed attacks on an affected host.

The Attack Discovery Worker isn't the best fit when:

  • Most of your alerts are false positives. Turn on the Alert Triage Worker first, so the Attack Discovery Worker analyzes fewer, more meaningful alerts.
  • Your space generates far more than 10,000 alerts in 24 hours. Each time the Attack Discovery Worker runs, it retrieves up to 10,000 alerts for each 24-hour period since its previous run, so reduce alert volume first.

The Attack Discovery Worker needs detection alerts in the space with a status of open or acknowledged. It skips building block alerts and alerts closed as false positives.

On each run, the Attack Discovery Worker:

  1. Runs the Attack Discovery feature of Elastic Security on open and acknowledged alerts to find candidate attacks.
  2. Opens one investigation for each candidate attack, or adds the attack to an open investigation for the same attack.
  3. Judges whether each attack is a false positive.
  4. For a false positive, acknowledges the open alerts and closes the attack and the investigation. For an attack it confirms or can't rule out, proposes handing the attack to the Forensics Watch for forensics.

Because the Attack Discovery Worker analyzes only open and acknowledged alerts, it skips any alert that the Alert Triage Worker closed as a false positive.

You review the Attack Discovery Worker's proposed actions in the Investigate section of the Proposed actions page. To learn how to take an attack from the Attack Discovery Worker's verdict to containment, refer to Respond to an attack.

Over one day, alerts fire on the same host for a suspicious PowerShell command, a new scheduled task, and an outbound connection to a rarely seen domain. The Attack Discovery Worker groups the alerts into one candidate attack and opens an investigation. It can't rule the attack out, so it proposes handing the attack to the Forensics Watch. After you approve, the Endpoint Analysis Worker investigates the host.

Schedule

How often the Attack Discovery Worker runs.

Default: Every 24 hours. Each time the Attack Discovery Worker runs, it starts where its previous run ended.

Autonomy

How much the Attack Discovery Worker does without you. You can set it to Manual or Supervised. Refer to what it does at each level.

Default: Manual

Models
Opens Feature settings, where you select the models that AlertZero uses in the space. The Attack Discovery Worker has no model setting of its own, so it uses the models you select there.