---
title: Detection Watch
description: The AlertZero Detection Watch improves your Elastic Security detection rules at the source, and you approve every change before it reaches your rules.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/detection-watch
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Detection Watch
The Detection Watch improves your detection rules at the source, instead of handling the alerts they produce one by one.

| Worker                                                                                                                                        | What it does                                       | Works with                                                                                                                                                                                                                                                                                                                                                                             |
|-----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Rule Tuning](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-tuning-worker)     | Tunes rules that produce too many false positives. | The [Alert Triage Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/alert-triage-worker) in the [Triage Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/triage-watch), whose false positive closures this Worker counts, along with the ones people make. |
| [Rule Coverage](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-coverage-worker) | Proposes rules to close detection gaps.            | The [Continuous Threat Hunt Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/continuous-threat-hunt-worker) in the [Hunt Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/hunt-watch), which finds the detection gaps this Worker proposes rules for.     |

You review the Watch's proposed changes and rules in the **Configure** section of the **Proposed actions** page. Neither Worker offers **Supervised** autonomy, so you approve every change before it reaches your rules. To learn how to approve a rule change or a new rule, refer to [Decide a detection change](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/decide-detection-change).

## When to turn on the Detection Watch

Turn on the Detection Watch when noisy rules or missing detections cost your team time:
- Turn on the Rule Tuning Worker when a few rules produce most of your false positives. To learn whether your rules and data are a good fit, refer to [when to use Rule Tuning](/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-tuning-worker#alertzero-rule-tuning-when-to-use).
- Turn on the Rule Coverage Worker together with the [Hunt Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/hunt-watch), because it works only on the detection gaps that Watch records. To learn whether it fits your environment, refer to [when to use Rule Coverage](/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-coverage-worker#alertzero-rule-coverage-when-to-use).