---
title: Forensics Watch
description: The AlertZero Forensics Watch runs forensics on attacks in Elastic Security, doing deep research on threats and exploits.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/forensics-watch
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Forensics Watch
The Forensics Watch does deep research on threats and exploits, running forensics on an attack.

| Worker                                                                                                                                                | What it does                                                                         | Works with                                                                                                                                                                                                                                                                                                                                                        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Endpoint Analysis](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/endpoint-analysis-worker) | Reconstructs the attack timeline on one affected host and proposes response actions. | The [Attack Discovery Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker) in the [Triage Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/triage-watch), which hands off the attacks this Worker investigates. |


## When to turn on the Forensics Watch

Turn on the Forensics Watch when you want AlertZero to investigate confirmed attacks on an affected host. It works only on attacks that the [Attack Discovery Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker) hands off, so turn it on together with the [Triage Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/triage-watch). It also needs data from [Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/configure-elastic-defend/install-elastic-defend) on your hosts.