---
title: Run a Worker on demand
description: Run an AlertZero Worker outside its schedule.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/run-worker-on-demand
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Run a Worker on demand
A Worker normally runs on its own schedule. You can also start a run yourself, for example to see the effect of a settings change without waiting for the next scheduled run. You start the run from the **Workflows** page, because each Worker is a [managed workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/workflows/managed-workflows).

## Before you begin

- Turn the Worker on. A Worker that's turned off can't be run. Refer to [Configure Worker settings > Turn a Worker on or off and view its runs](/elastic/docs-content/pull/9144/solutions/security/alertzero/configure-worker-settings#configure-worker-settings-enabled).
- Turn on the [**Show managed workflows**](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/advanced-settings#kibana-workflows-settings) advanced setting. Managed workflows are hidden by default, and the **Workflows** page can't show a Worker while they're hidden. Refer to [Set up Workflows > Show managed workflows](/elastic/docs-content/pull/9144/explore-analyze/workflows/get-started/setup#workflows-managed-visibility).
- Make sure your role includes the privilege to run workflows. Refer to [AlertZero privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/alertzero-privileges).


## What to expect from an on-demand run

A run that you start from the workflow list is an extra run, in addition to the scheduled ones. The Worker still runs on its schedule, and the extra run produces the same kinds of results as a scheduled run, such as proposed actions and investigations.
A run that you start uses the same autonomy level as a scheduled run, with one exception: the Endpoint Analysis Worker. When you run it yourself, it always uses **Manual** autonomy, even if you set it to **Supervised**. Any containment proposed actions that it creates wait for your approval.

## Run a Worker

1. Find **Workflows** in the navigation menu or use the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/explore-analyze/find-and-organize/find-apps-and-objects).
2. Select **View**, then select **Managed** so that managed workflows appear in the list.
3. In the workflow list, find the Worker.
4. In the Worker's row, select **Run** `play`.

To check the result of the run, refer to [View execution history](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9144/solutions/security/alertzero/view-execution-history).
<important>
  Start the run from the workflow list, not from the workflow editor that **View executions** opens. A run that you start in the editor is a test run, which is meant for trying out a workflow while you author it, not for production runs. For more information, refer to [Use the YAML editor > Test runs and production runs](/elastic/docs-content/pull/9144/explore-analyze/workflows/authoring-techniques/use-yaml-editor#workflows-test-vs-production-runs).
</important>