---
title: Close false-positive alerts
description: Review the false-positive alerts that the AlertZero Alert Triage Worker proposes to close in Elastic Security, approve or decline each batch, and reopen any closures you disagree with.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/close-false-positive-alerts
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Close false-positive alerts
The Alert Triage Worker reviews your open and acknowledged alerts and finds the ones it judges to be false positives. Its [autonomy](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/configure-worker-settings) controls what it does with them.
- With **Manual** autonomy (the default), the Worker proposes closing the false positives and waits for you to [review](#alertzero-close-false-positives-review) and [approve or decline](#alertzero-close-false-positives-decide) each proposed closure.
- With **Supervised** autonomy, the Worker closes the false positives on its own. You [check its closures](#alertzero-close-false-positives-past-closures) afterward and reopen any that you disagree with.


## How the Alert Triage Worker picks alerts to close

By default, the Alert Triage Worker runs every 15 minutes and triages alerts of every severity. It proposes closing an alert only when it's at least 85% confident that the alert is a false positive. It tags alerts with a lower score `az:inconclusive` and leaves them open for you to triage.
The Worker groups false positives from the same rule that share a pattern into one proposed action. For example, if a backup agent on many hosts runs from the same folder, with the same publisher signature and the same parent process, its alerts become one proposed action.
To change how often the Worker runs, which alerts it triages, or how confident it must be before it proposes a closure, refer to [Configure Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/configure-worker-settings).

## Review a proposed closure

Open the proposed closure on the **Proposed actions** page, and check that the reasoning holds for every alert in the batch. Start with how many alerts the closure covers, which rule they came from, and which hosts and users they involve. A host or user you don't expect for that rule is a reason to look closer. The Worker also adds a note to each alert that explains why it judged the alert a false positive, so look for a note whose reasoning doesn't match what the alert shows.
You decide the batch as a whole. If some alerts need a closer look, ask in the investigation's chat to remove them from the closure, or decline the closure and handle the alerts one by one.

## Approve or decline a proposed closure

After you review a closure, approve or decline it.
- **If you approve:** The alerts close as false positives. The closure runs under your account, so you need the [privileges to close alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/alertzero-privileges). Without them, the closure fails.
- **If you decline:** The alerts stay open, tagged `az:inconclusive`. The same happens if the proposed action [expires](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/work-in-alertzero) before anyone decides.

<important>
  You can't change your decision on a proposed closure. If you approve one by mistake, [reopen its alerts](#alertzero-close-false-positives-past-closures). Until you do, the Attack Discovery Worker skips them, so it might miss part of an attack.
</important>


## Check and reopen past closures

Check closures regularly, especially soon after your team switches the Alert Triage Worker to Supervised autonomy.
**Closed Actions** on the **Proposed actions** page lists decisions from the last 72 hours, with the evidence behind each one. A closure that the Worker made on its own names the Worker.
If you disagree with a closure, [reopen its alerts](/elastic/docs-content/pull/9157/solutions/security/detect-and-alert/manage-detection-alerts#detection-alert-status) on the **Alerts** page, where you can also find alerts from older closures. The Attack Discovery Worker then considers the reopened alerts again.

## Next steps

- [Respond to an attack](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/respond-to-attack) that the Attack Discovery Worker finds.
- [Find other work that Workers bring you](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/work-in-alertzero).