Rule Coverage Worker

The Rule Coverage Worker is part of the Detection Watch. It proposes rules to close the detection gaps that threat hunts find. This page explains when to use the Rule Coverage Worker, what data it needs, how it works on each gap, where to decide its proposed actions, and which settings and limits apply.

The Rule Coverage Worker is the right fit when:

  • You use the Continuous Threat Hunt Worker and want a rule for each detection gap it finds.
  • You want to use existing rules, including Elastic prebuilt rules, before you write new ones.

The Rule Coverage Worker isn't the best fit when:

  • The Hunt Watch is off. Without the gaps it records, the Rule Coverage Worker has nothing to work on.
  • You need new rules of a type other than ES|QL. The new rules it drafts are always ES|QL rules.

The Rule Coverage Worker needs detection gaps that the Continuous Threat Hunt Worker recorded within the lookback period.

On each run, the Rule Coverage Worker:

  1. Opens one investigation for each detection gap.
  2. Checks whether a rule already covers the gap.
  3. Proposes turning on an existing rule, installing a prebuilt rule, or creating a new ES|QL rule. A new rule comes with a Backtest that shows how often the rule matches your past data. If a rule already covers the gap, it asks you to confirm that instead.

The Rule Coverage Worker works only on the detection gaps that the Continuous Threat Hunt Worker in the Hunt Watch records after each successful hunt.

You review the Rule Coverage Worker's proposed rules in the Configure section of the Proposed actions page. To learn how to approve a rule before it takes effect, refer to Decide a detection change.

A threat hunt finds activity that matches a credential dumping technique, but no enabled rule detects it. The Rule Coverage Worker opens an investigation for the gap, finds a prebuilt rule that covers it but isn't on, and proposes turning the rule on. If no rule covers a gap, the Rule Coverage Worker drafts a new ES|QL rule instead, with a Backtest of how often it matches your past data.

Schedule

How often the Rule Coverage Worker runs.

Default: Every hour

Autonomy

How much the Rule Coverage Worker does without you. You can set it to Manual or Assisted, and at either level, you approve each rule before it takes effect. Refer to what it does at each level.

Default: Manual

Models
Opens Feature settings, where you select the models that AlertZero uses in the space. The Rule Coverage Worker has no model setting of its own, so it uses the models you select there.
Lookback (days)

How far back it looks for gaps.

Default: 14 days, and you can set it from 8 to 90 days.

Max gaps per run

The most gaps the Rule Coverage Worker works on each time it runs.

Default: 5, and you can set it from 1 to 50.

  • The Rule Coverage Worker reviews up to 100 detection gaps at a time in each space. When it reaches that limit, it starts on new gaps only as earlier reviews finish.