---
title: Configure Worker settings
description: Turn an AlertZero Worker on or off, and set its autonomy and other settings.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/configure-worker-settings
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Configure Worker settings
When you turn on Workers during setup, they start with their default settings. You can change these defaults on the **Watches** page.
Each Worker has its own settings, and the autonomy levels control different things for each Worker. This page describes each Worker's settings, grouped by Watch.

## Before you begin

To change these settings, you need a privilege that lets you manage AlertZero. Refer to [AlertZero privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/alertzero-privileges).

## Change a Worker's settings

1. Find **Watches** in the navigation menu or use the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/find-and-organize/find-apps-and-objects).
2. Open the Watch that contains the Worker.
3. Change the settings for the Worker.
4. Select **Save**.


## Turn a Worker on or off and view its runs

These two settings apply to every Worker. The sections that follow cover the other settings of each Worker.
<definitions>
  <definition term="Enabled">
    Turns the Worker on or off.
  </definition>
  <definition term="View executions">
    Opens the Worker's execution history in the workflow editor, where you can check what it did and whether each run succeeded. Refer to [View execution history](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/view-execution-history).
  </definition>
</definitions>


## Triage Watch

The Triage Watch includes the Alert Triage and Attack Discovery Workers. You configure each Worker separately.

### Alert Triage

Alert Triage has the following settings.
<definitions>
  <definition term="Autonomy">
    Sets whether Alert Triage needs your approval to close false positives.
    - **Manual**: Alert Triage classifies new alerts and proposes closing the false positives. You approve or decline each proposed closure.
    - **Supervised**: Alert Triage classifies new alerts and closes false positives on its own. You can reopen closed alerts that you disagree with.
  </definition>
  <definition term="Schedule">
    How often Alert Triage checks for alerts that are waiting to be triaged.
  </definition>
</definitions>

<definitions>
  <definition term="Models">
    The Worker uses the models configured in **Feature Settings**. Refer to [Manage access to AI features](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/ai-features/manage-access-to-ai-assistant).
  </definition>
</definitions>

<definitions>
  <definition term="Minimum confidence score">
    How confident Alert Triage must be that an alert is a false positive before it proposes closing the alert or closes it. A false positive below this score is classified as inconclusive and stays open. A higher score means fewer alerts are closed, so it's the safer choice if you want to review more alerts yourself. A lower score means more alerts are closed.
  </definition>
  <definition term="Minimum severity">
    The lowest alert severity to triage. Alerts below this severity are skipped. To triage every alert, select **Low**.
  </definition>
  <definition term="Exclude building block alerts">
    Skips the alerts that any rule configured as a [building block rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/detect-and-alert/about-building-block-rules) generates.
  </definition>
  <definition term="Excluded rule tags">
    Skips alerts from rules that carry any of these tags. Press **Enter** after each tag to add more than one. Tags are case-sensitive.
  </definition>
</definitions>


### Attack Discovery

Attack Discovery has the following settings.
<definitions>
  <definition term="Autonomy">
    Sets whether Attack Discovery needs your approval to hand an attack to the Forensics Watch.
    - **Manual**: Attack Discovery opens an investigation for each potential attack. For each attack it confirms or can't rule out, it proposes handing the attack to the Forensics Watch. You approve or decline each handoff.
    - **Supervised**: Attack Discovery opens an investigation for each potential attack and hands the attacks it confirms or can't rule out to the Forensics Watch on its own.
  </definition>
  <definition term="Schedule">
    How often Attack Discovery looks for potential attacks.
  </definition>
</definitions>

<definitions>
  <definition term="Models">
    The Worker uses the models configured in **Feature Settings**. Refer to [Manage access to AI features](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/ai-features/manage-access-to-ai-assistant).
  </definition>
</definitions>


## Hunt Watch

The Hunt Watch includes the Continuous Threat Hunt Worker.

### Continuous Threat Hunt

Continuous Threat Hunt has the following settings.
<definitions>
  <definition term="Threat intel supply">
    The workflows that build the threat reports that Continuous Threat Hunt hunts: **Ingest threat feeds**, **Enrich threat report**, and **Attribute alerts to reports**. AlertZero turns them on when you turn on Continuous Threat Hunt, but only if your deployment meets the [requirements](/elastic/docs-content/pull/9144/solutions/security/alertzero/threat-reports#alertzero-threat-reports-requirements). Otherwise, the settings show what's missing. To learn what each workflow does, refer to [How AlertZero builds threat reports > How it works](/elastic/docs-content/pull/9144/solutions/security/alertzero/threat-reports#alertzero-threat-reports). To learn which ones all spaces share, refer to [How AlertZero builds threat reports > How the threat intelligence workflows apply to spaces](/elastic/docs-content/pull/9144/solutions/security/alertzero/threat-reports#alertzero-threat-reports-spaces).
    If a workflow is off while Continuous Threat Hunt is on, select **Restore threat intel supply** in the callout to turn it back on. You can also turn these workflows on or off from the **Workflows** page after you turn on [**Show managed workflows**](/elastic/docs-content/pull/9144/explore-analyze/workflows/get-started/setup#workflows-managed-visibility). Refer to [Manage and organize workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/workflows/authoring-techniques/manage-workflows).
  </definition>
  <definition term="Autonomy">
    Continuous Threat Hunt always uses **Manual** autonomy. It hunts each threat report, opens an investigation for it, and proposes response actions for the threats it finds. You approve or decline each proposed action.
  </definition>
  <definition term="Schedule">
    How often Continuous Threat Hunt searches your data for activity that matches threat reports. The interval is fixed, so you can't change it. It runs every 4 hours.
  </definition>
</definitions>

<definitions>
  <definition term="Models">
    The Worker uses the models configured in **Feature Settings**. Refer to [Manage access to AI features](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/ai-features/manage-access-to-ai-assistant).
  </definition>
</definitions>


## Detection Watch

The Detection Watch includes the Rule Tuning and Rule Coverage Workers. You configure each Worker separately.

### Rule Tuning

Rule Tuning has the following settings.
<definitions>
  <definition term="Autonomy">
    Sets whether Rule Tuning needs your approval before it analyzes a rule. Applying a tuning change always waits for your approval.
    - **Manual**: Rule Tuning finds each qualifying rule, but waits for your approval before it analyzes the rule. You also approve or decline each proposed tuning change.
    - **Assisted**: Rule Tuning analyzes each qualifying rule on its own and proposes a tuning change. You approve or decline each proposed change.
  </definition>
  <definition term="Schedule">
    How often Rule Tuning looks for rules to analyze.
  </definition>
</definitions>

<definitions>
  <definition term="Models">
    The Worker uses the models configured in **Feature Settings**. Refer to [Manage access to AI features](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/ai-features/manage-access-to-ai-assistant).
  </definition>
</definitions>

<definitions>
  <definition term="Analysis window (days)">
    The period of alerts Rule Tuning considers when it checks the qualifying thresholds and analyzes a rule. Alerts older than this period don't count toward either threshold.
  </definition>
  <definition term="Qualifying thresholds">
    When a rule qualifies for analysis. A rule qualifies only when both thresholds are met within the analysis window. Both count alerts closed as false positives.
    - **False positive count**: The number of false positive alerts.
    - **False positive rate**: The percentage of alerts that are false positives.
  </definition>
</definitions>


### Rule Coverage

Rule Coverage has the following settings.
<definitions>
  <definition term="Autonomy">
    Sets whether Rule Coverage needs your approval before it checks a detection gap. The proposed next step always waits for your approval.
    - **Manual**: Rule Coverage reviews the detection gaps that the Hunt Watch finds, but waits for your approval before it checks a gap. You also approve or decline each proposed next step.
    - **Assisted**: Rule Coverage checks each gap on its own and proposes a next step, such as drafting a new rule or installing a prebuilt rule. You approve or decline each proposed next step.
  </definition>
  <definition term="Schedule">
    How often Rule Coverage picks up new detection gaps to review.
  </definition>
</definitions>

<definitions>
  <definition term="Models">
    The Worker uses the models configured in **Feature Settings**. Refer to [Manage access to AI features](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/ai-features/manage-access-to-ai-assistant).
  </definition>
</definitions>

<definitions>
  <definition term="Lookback (days)">
    How many days back each run looks for coverage gaps that haven't been reviewed. Older gaps are not reviewed.
  </definition>
  <definition term="Max gaps per run">
    The maximum number of detection gaps Rule Coverage reviews in a single run.
  </definition>
</definitions>


## Forensics Watch

The Forensics Watch includes the Endpoint Analysis Worker.

### Endpoint Analysis

Endpoint Analysis has the following settings.
<definitions>
  <definition term="Autonomy">
    Sets whether response actions need your approval.
    - **Manual**: Endpoint Analysis adds an attack timeline, indicators of compromise, and its rationale to the investigation, and proposes response actions, such as isolating a host, terminating a process, or suspending a process. You approve or decline each proposed response action.
    - **Supervised**: Endpoint Analysis adds the same details to the investigation and runs those response actions on its own. You review the results afterward.
    <warning>
      With **Supervised** autonomy, Endpoint Analysis isolates hosts, terminates processes, or suspends processes without waiting for your approval. Isolating a host blocks its communication with other hosts on your network, and killing or suspending a process interrupts whatever that process is doing. Use **Supervised** only if you're confident in your response procedures.
    </warning>
  </definition>
</definitions>

<definitions>
  <definition term="Models">
    The Worker uses the models configured in **Feature Settings**. Refer to [Manage access to AI features](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/ai-features/manage-access-to-ai-assistant).
  </definition>
</definitions>


## Related pages

- [Run a Worker on demand](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/run-worker-on-demand)
- [View execution history](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/view-execution-history)
- [Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/watches-and-workers)
- [AlertZero privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/alertzero-privileges)