Configure Worker settings

When you turn on Workers during setup, they start with their default settings. You can change these defaults on the Watches page.

Each Worker has its own settings, and the autonomy levels control different things for each Worker. This page describes each Worker's settings, grouped by Watch.

To change these settings, you need a privilege that lets you manage AlertZero. Refer to AlertZero privileges.

  1. Find Watches in the navigation menu or use the global search field.
  2. Open the Watch that contains the Worker.
  3. Change the settings for the Worker.
  4. Select Save.

These two settings apply to every Worker. The sections that follow cover the other settings of each Worker.

Enabled
Turns the Worker on or off.
View executions
Opens the Worker's execution history in the workflow editor, where you can check what it did and whether each run succeeded. Refer to View execution history.

The Triage Watch includes the Alert Triage and Attack Discovery Workers. You configure each Worker separately.

Alert Triage has the following settings.

Autonomy

Sets whether Alert Triage needs your approval to close false positives.

  • Manual: Alert Triage classifies new alerts and proposes closing the false positives. You approve or decline each proposed closure.
  • Supervised: Alert Triage classifies new alerts and closes false positives on its own. You can reopen closed alerts that you disagree with.
Schedule
How often Alert Triage checks for alerts that are waiting to be triaged.
Models
The Worker uses the models configured in Feature Settings. Refer to Manage access to AI features.
Minimum confidence score
How confident Alert Triage must be that an alert is a false positive before it proposes closing the alert or closes it. A false positive below this score is classified as inconclusive and stays open. A higher score means fewer alerts are closed, so it's the safer choice if you want to review more alerts yourself. A lower score means more alerts are closed.
Minimum severity
The lowest alert severity to triage. Alerts below this severity are skipped. To triage every alert, select Low.
Exclude building block alerts
Skips the alerts that any rule configured as a building block rule generates.
Excluded rule tags
Skips alerts from rules that carry any of these tags. Press Enter after each tag to add more than one. Tags are case-sensitive.

Attack Discovery has the following settings.

Autonomy

Sets whether Attack Discovery needs your approval to hand an attack to the Forensics Watch.

  • Manual: Attack Discovery opens an investigation for each potential attack. For each attack it confirms or can't rule out, it proposes handing the attack to the Forensics Watch. You approve or decline each handoff.
  • Supervised: Attack Discovery opens an investigation for each potential attack and hands the attacks it confirms or can't rule out to the Forensics Watch on its own.
Schedule
How often Attack Discovery looks for potential attacks.
Models
The Worker uses the models configured in Feature Settings. Refer to Manage access to AI features.

The Hunt Watch includes the Continuous Threat Hunt Worker.

Continuous Threat Hunt has the following settings.

Threat intel supply

The workflows that build the threat reports that Continuous Threat Hunt hunts: Ingest threat feeds, Enrich threat report, and Attribute alerts to reports. AlertZero turns them on when you turn on Continuous Threat Hunt, but only if your deployment meets the requirements. Otherwise, the settings show what's missing. To learn what each workflow does, refer to How AlertZero builds threat reports > How it works. To learn which ones all spaces share, refer to How AlertZero builds threat reports > How the threat intelligence workflows apply to spaces.

If a workflow is off while Continuous Threat Hunt is on, select Restore threat intel supply in the callout to turn it back on. You can also turn these workflows on or off from the Workflows page after you turn on Show managed workflows. Refer to Manage and organize workflows.

Autonomy
Continuous Threat Hunt always uses Manual autonomy. It hunts each threat report, opens an investigation for it, and proposes response actions for the threats it finds. You approve or decline each proposed action.
Schedule
How often Continuous Threat Hunt searches your data for activity that matches threat reports. The interval is fixed, so you can't change it. It runs every 4 hours.
Models
The Worker uses the models configured in Feature Settings. Refer to Manage access to AI features.

The Detection Watch includes the Rule Tuning and Rule Coverage Workers. You configure each Worker separately.

Rule Tuning has the following settings.

Autonomy

Sets whether Rule Tuning needs your approval before it analyzes a rule. Applying a tuning change always waits for your approval.

  • Manual: Rule Tuning finds each qualifying rule, but waits for your approval before it analyzes the rule. You also approve or decline each proposed tuning change.
  • Assisted: Rule Tuning analyzes each qualifying rule on its own and proposes a tuning change. You approve or decline each proposed change.
Schedule
How often Rule Tuning looks for rules to analyze.
Models
The Worker uses the models configured in Feature Settings. Refer to Manage access to AI features.
Analysis window (days)
The period of alerts Rule Tuning considers when it checks the qualifying thresholds and analyzes a rule. Alerts older than this period don't count toward either threshold.
Qualifying thresholds

When a rule qualifies for analysis. A rule qualifies only when both thresholds are met within the analysis window. Both count alerts closed as false positives.

  • False positive count: The number of false positive alerts.
  • False positive rate: The percentage of alerts that are false positives.

Rule Coverage has the following settings.

Autonomy

Sets whether Rule Coverage needs your approval before it checks a detection gap. The proposed next step always waits for your approval.

  • Manual: Rule Coverage reviews the detection gaps that the Hunt Watch finds, but waits for your approval before it checks a gap. You also approve or decline each proposed next step.
  • Assisted: Rule Coverage checks each gap on its own and proposes a next step, such as drafting a new rule or installing a prebuilt rule. You approve or decline each proposed next step.
Schedule
How often Rule Coverage picks up new detection gaps to review.
Models
The Worker uses the models configured in Feature Settings. Refer to Manage access to AI features.
Lookback (days)
How many days back each run looks for coverage gaps that haven't been reviewed. Older gaps are not reviewed.
Max gaps per run
The maximum number of detection gaps Rule Coverage reviews in a single run.

The Forensics Watch includes the Endpoint Analysis Worker.

Endpoint Analysis has the following settings.

Autonomy

Sets whether response actions need your approval.

  • Manual: Endpoint Analysis adds an attack timeline, indicators of compromise, and its rationale to the investigation, and proposes response actions, such as isolating a host, terminating a process, or suspending a process. You approve or decline each proposed response action.
  • Supervised: Endpoint Analysis adds the same details to the investigation and runs those response actions on its own. You review the results afterward.
Warning

With Supervised autonomy, Endpoint Analysis isolates hosts, terminates processes, or suspends processes without waiting for your approval. Isolating a host blocks its communication with other hosts on your network, and killing or suspending a process interrupts whatever that process is doing. Use Supervised only if you're confident in your response procedures.

Models
The Worker uses the models configured in Feature Settings. Refer to Manage access to AI features.