Watches and Workers
A Watch covers one area of security work and includes one or more Workers. Workers in different Watches often depend on each other. Refer to Watches and Workers > How Workers work together.
A Worker also needs certain features and integrations to be set up. Without them, a Worker can't work, or works only in part, so set them up before you turn the Worker on. To change a Worker's settings, refer to Configure Worker settings.
Some Workers use what other Workers produce, so turning one off can leave another with nothing to work on. Use the following table to decide which Workers to keep on.
| Worker | Watch | What it does | Works with |
|---|---|---|---|
| Alert Triage | Triage Watch | Classifies alerts and proposes closing false positives. | Rule Tuning, which learns from the alerts that Alert Triage classifies as false positives. |
| Attack Discovery | Triage Watch | Groups related alerts into potential attacks and proposes handing them off for a deeper investigation. | Endpoint Analysis, which investigates the attacks that Attack Discovery hands off. |
| Continuous Threat Hunt | Hunt Watch | Hunts your data for activity that matches threat reports and records the detection gaps it finds. | Rule Coverage, which reviews the gaps that Continuous Threat Hunt records. |
| Rule Tuning | Detection Watch | Proposes tuning changes for rules that produce many false positives. | Alert Triage. Without it, Rule Tuning still works, but has fewer alerts to learn from. |
| Rule Coverage | Detection Watch | Proposes a fix for each detection gap, such as turning on an existing rule, installing a prebuilt rule, or drafting a new one. | Continuous Threat Hunt. Without it, Rule Coverage has no gaps to review. |
| Endpoint Analysis | Forensics Watch | Reconstructs the attack timeline on an affected host and proposes response actions. | Attack Discovery. Without it, Endpoint Analysis has no attacks to investigate. |
The Triage Watch is your first line of defense. It reviews incoming alerts and finds potential attacks.
The Alert Triage Worker reviews alerts that are waiting to be triaged. It classifies each alert as a true positive, a false positive, or, if the false positive confidence score is below the threshold set in the Minimum confidence score setting, inconclusive. It adds its classification to the alert as a tag and a note, and proposes closing the false positives.
Alert Triage relies on the Alert analysis workflow to analyze alerts, so make sure that workflow is turned on.
Each proposed closure appears as a proposed action on the Proposed actions page. To find it, refer to Use AlertZero, and to decide what to do with it, refer to Decide a proposed action.
The Attack Discovery Worker groups related alerts into potential attacks and opens an investigation for each one. For each attack that it confirms as a true positive or can't rule out, it proposes handing the attack to the Forensics Watch for a deeper investigation. It doesn't hand off false positives.
To generate discoveries, Attack Discovery needs the Attack Discovery Workflows advanced setting turned on in the current space. It also needs Context Engine so that the attacks it hands off can reach the Endpoint Analysis Worker in the Forensics Watch.
The handoff appears in the attack's investigation as a proposed action. To decide whether to hand off the attack, refer to Respond to an attack.
The Hunt Watch proactively looks for threats in your data without waiting for an alert.
The Continuous Threat Hunt Worker searches your data for activity that matches threat reports, opens an investigation for each threat report it hunts, and proposes response actions for the threats it finds, such as isolating a host. It also records the detection gaps that it finds, so the Rule Coverage Worker in the Detection Watch can review them.
Continuous Threat Hunt works from threat reports, which AlertZero builds for you from public threat feeds. It can't start hunting until the workflows that build reports have run. Building reports needs outbound network access to the feeds, models configured in the default space, and your cluster's default embedding endpoint. Continuous Threat Hunt also needs Context Engine so that it can record detection gaps for Rule Coverage.
Each hunt finding appears in its investigation, with the finding's severity, confidence, and the evidence behind it. To decide what to do with a finding, refer to Act on a hunt finding.
The Detection Watch improves your detection rules at the source, instead of handling the alerts they produce one by one. Its Workers build on what other Watches produce.
The Rule Tuning Worker finds rules that produce many false positives, diagnoses why, and proposes a tuning change.
Rule Tuning needs alerts that are marked as false positives. It counts the alerts that Alert Triage in the Triage Watch classified as false positives, and the alerts that human users closed as false positives. Rule Tuning can still work without Alert Triage, but it then has fewer alerts to learn from.
Each rule that Rule Tuning reviews has its own investigation, with the tuning change as a proposed action. To decide on a tuning change, refer to Decide a detection change.
The Rule Coverage Worker reviews the detection gaps that Continuous Threat Hunt in the Hunt Watch records. For each gap, it checks whether a rule already covers it, and proposes the simplest fix, such as enabling a disabled rule or installing a prebuilt rule. If no rule fits, it drafts a new one.
Rule Coverage depends on the gaps that Continuous Threat Hunt records, so if that Worker is off, Rule Coverage has nothing to review. It also needs Context Engine so that it can process the recorded gaps.
Each gap has its own investigation, with the fix as a proposed action. To decide on a fix, refer to Decide a detection change.
The Forensics Watch does deep research on an attack. It works on attacks that Attack Discovery in the Triage Watch hands off.
The Endpoint Analysis Worker reconstructs the attack timeline on the affected host, extracts indicators of compromise, and proposes response actions, such as isolating a host or terminating a process.
Endpoint Analysis works only on the attacks that Attack Discovery hands off, and it doesn't look for attacks on its own. It also needs Elastic Defend to be set up so that it can investigate hosts, and it analyzes only hosts that have Elastic Defend data from around the time of the attack.
To read and update investigations, Endpoint Analysis also needs Context Engine.
Endpoint Analysis adds its findings to the investigation that Attack Discovery opened for the attack, and the response actions appear there as proposed actions. To decide on them, refer to Respond to an attack.
When no response actions are waiting for your decision, Endpoint Analysis proposes closing the investigation. If you approve, AlertZero closes the investigation, the attack, and the attack's alerts.