--- title: Attack Discovery Worker description: Find what the AlertZero Attack Discovery Worker does in Elastic Security, how it hands attacks to forensics, and its limits. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker products: - Elastic Cloud Serverless - Elastic Documentation - Elastic Security applies_to: - Serverless Security projects: Preview - Elastic Stack: Planned --- # Attack Discovery Worker The Attack Discovery Worker is part of the [Triage Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/triage-watch). It groups related alerts into candidate attacks and checks each one before it reaches you. This page explains when to use the Attack Discovery Worker, what data it needs, how it finds and checks attacks, where to decide its proposed actions, and which limits apply. ## When to use the Attack Discovery Worker The Attack Discovery Worker is the right fit when: - You want the Attack Discovery Worker to connect related alerts into attacks, instead of piecing them together yourself. - You want the Attack Discovery Worker to check each candidate attack for false positives before it reaches you. - You want the [Forensics Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/forensics-watch) to investigate confirmed attacks on an affected host. The Attack Discovery Worker isn't the best fit when: - Most of your alerts are false positives. Turn on the [Alert Triage Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/alert-triage-worker) first, so the Attack Discovery Worker analyzes fewer, more meaningful alerts. - Your space generates far more than 10,000 alerts in 24 hours. Each time the Attack Discovery Worker runs, it retrieves up to 10,000 alerts for each 24-hour period since its previous run, so reduce alert volume first. ## Data requirements The Attack Discovery Worker needs detection alerts in the space with a status of open or acknowledged. It skips building block alerts and alerts closed as false positives. ## How it works On each run, the Attack Discovery Worker: 1. Runs the [Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/ai/attack-discovery) feature of Elastic Security on open and acknowledged alerts to find candidate attacks. 2. Opens one investigation for each candidate attack, or adds the attack to an open investigation for the same attack. 3. Judges whether each attack is a false positive. 4. For a false positive, acknowledges the open alerts and closes the attack and the investigation. For an attack it confirms or can't rule out, proposes handing the attack to the [Forensics Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/forensics-watch) for forensics. Because the Attack Discovery Worker analyzes only open and acknowledged alerts, it skips any alert that the [Alert Triage Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/alert-triage-worker) closed as a false positive. You review the Attack Discovery Worker's proposed actions in the **Investigate** section of the **Proposed actions** page. To learn how to take an attack from the Attack Discovery Worker's verdict to containment, refer to [Respond to an attack](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/respond-to-attack). ### Example Over one day, alerts fire on the same host for a suspicious PowerShell command, a new scheduled task, and an outbound connection to a rarely seen domain. The Attack Discovery Worker groups the alerts into one candidate attack and opens an investigation. It can't rule the attack out, so it proposes handing the attack to the Forensics Watch. After you approve, the [Endpoint Analysis Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/endpoint-analysis-worker) investigates the host. ## Settings How often the Attack Discovery Worker runs. Default: Every 24 hours. Each time the Attack Discovery Worker runs, it starts where its previous run ended. How much the Attack Discovery Worker does without you. You can set it to **Manual** or **Supervised**. Refer to [what it does at each level](/elastic/docs-content/pull/9118/solutions/security/alertzero/configure-worker-settings#alertzero-worker-autonomy). Default: Manual Opens **Feature settings**, where you select the models that AlertZero uses in the space. The Attack Discovery Worker has no model setting of its own, so it uses the models you select there. ## Limits - Each time the Attack Discovery Worker runs, it retrieves up to 10,000 alerts for each 24-hour period since its previous run. - You can't [run the Attack Discovery Worker manually](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/run-worker-on-demand).