---
title: Triage Watch
description: The AlertZero Triage Watch reviews incoming Elastic Security alerts so that people see only the ones that still need a person.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/triage-watch
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Triage Watch
The Triage Watch reviews incoming alerts so your analysts see only the ones that need their attention.

| Worker                                                                                                                                              | What it does                                                | Works with                                                                                                                                                                                                                                                                                                                                                                                                                       |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Alert Triage](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/alert-triage-worker)         | Classifies alerts and proposes closing the false positives. | The [Attack Discovery Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker), which skips the false positives this Worker closes, and the [Rule Tuning Worker](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/rule-tuning-worker), which counts them when it looks for rules to tune. |
| [Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker) | Groups related alerts into attacks and checks each one.     | The [Forensics Watch](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/forensics-watch), which investigates the attacks this Worker confirms or can't rule out.                                                                                                                                                                                                           |

You review the Watch's proposed actions in the **Investigate** section of the **Proposed actions** page. To learn how to decide the alert closures that the Alert Triage Worker proposes, refer to [Decide a proposed action](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/decide-proposed-action). To learn how to take a confirmed attack through to containment, refer to [Respond to an attack](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9118/solutions/security/alertzero/respond-to-attack).

## When to turn on the Triage Watch

Turn on the Triage Watch when your team spends more time sorting alerts than investigating them. Turn on both Workers together, because the Alert Triage Worker closes false positives and leaves the Attack Discovery Worker fewer, more meaningful alerts to analyze. To learn whether each Worker fits your environment and has the data it needs, refer to [when to use Alert Triage](/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/alert-triage-worker#alertzero-alert-triage-when-to-use) and [when to use Attack Discovery](/elastic/docs-content/pull/9118/solutions/security/alertzero/watches/attack-discovery-worker#alertzero-attack-discovery-when-to-use).