--- title: Tune noisy rules and fill detection gaps description: Review the detection rule changes that AlertZero proposes in Elastic Security: tuning changes for noisy rules from Rule Tuning, and new, installed, or turned-on rules for detection gaps from Rule Coverage. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/decide-detection-change products: - Elastic Cloud Serverless - Elastic Documentation - Elastic Security applies_to: - Serverless Security projects: Preview - Elastic Stack: Planned --- # Tune noisy rules and fill detection gaps The Detection Watch proposes two kinds of detection rule changes. The Rule Tuning Worker proposes changes that cut false positives from noisy rules. The Rule Coverage Worker proposes rules that cover the detection gaps that the Hunt Watch finds. Both Workers offer only Manual and Assisted autonomy, so every rule change waits for your approval. Approving a change doesn't give you the [privileges to make it](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/alertzero-privileges). ## How the Detection Watch proposes a change These are the default schedules and thresholds: - **Rule Tuning Worker:** Runs every 2 hours. It picks a rule when, over the last 7 days, at least 10 of the rule's alerts that it hasn't reviewed yet are false positives, and at least half of the rule's alerts are false positives. - **Rule Coverage Worker:** Runs every hour, and reviews up to 5 detection gaps from the last 14 days in each run. To change these defaults, refer to [Configure Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/configure-worker-settings). For more about what each Worker checks, refer to [Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/watches-and-workers). With **Manual** autonomy (the default), each Worker asks before it starts work on a change: - **Rule Tuning Worker:** Proposes **Review rule for tuning** for a noisy rule. If you decline, the Worker doesn't review those false positives again, but new ones can start a new review. - **Rule Coverage Worker:** Proposes **Review detection gap** for a gap. If you decline, the Worker leaves that gap out of future coverage checks. When you approve either one, the Worker drafts the change and proposes it for your review. With **Assisted** autonomy, the Workers skip this question and draft each change on their own. If a proposed action [expires](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/work-in-alertzero) before anyone decides, your rules stay as they are, and the Worker can ask again on a later run. ## Review a tuning change for a noisy rule Open the tuning change on the **Proposed actions** page, and check that it drops the false positives without hiding real threats. Start with why the Rule Tuning Worker picked the rule, based on how many of its recent alerts analysts or the Alert Triage Worker judged false positives. Then compare the rule before and after the change, and make sure an exception or query change is no broader than the noise it targets. If the change includes a backtest, check that it cuts only noise from the alerts on your past data. If someone edited the rule after the Worker proposed the change, decline the change, because approving it fails. Otherwise, approve or decline the change: - **If you approve:** AlertZero changes the rule in place or adds the exception. - **If you decline:** The rule stays as it is, and the investigation closes. To tune a rule by hand instead, refer to [Tune detection rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/detect-and-alert/tune-detection-rules). ## Decide how to fill a detection gap Open the proposed action for the gap on the **Proposed actions** page. What the Rule Coverage Worker proposes, and what happens when you approve it, depends on what the Worker finds: - **A new rule:** Check the rule's query and its backtest, which shows how often the rule matches your past data. A rule that matches often in the backtest is likely to be noisy once it's on. If you approve, AlertZero creates the ES|QL rule and turns it on under your account. The rule starts running at its next scheduled interval. - **A prebuilt rule:** If you approve, AlertZero installs the prebuilt rule and turns it on. - **An existing rule that's turned off:** If you approve, AlertZero turns on the rule. The rule starts creating alerts at its next scheduled run. - **Existing coverage:** A rule that's already on covers the gap. The check doesn't look at rule exceptions, so make sure that no exception narrows the rule's coverage before you approve. Approving records the coverage and leaves your rules as they are. - **A gap that needs follow-up:** The Worker has no change to propose, for example because it can't find the rule it checked. Follow up by hand. Approving doesn't run anything. If you decline, your rules stay as they are, and AlertZero discards any draft rule. To manage rules by hand, refer to [Manage detection rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/detect-and-alert/manage-detection-rules) and [Install Elastic prebuilt rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/detect-and-alert/install-prebuilt-rules). ## Undo a rule change To see or undo an approved change later, refer to [View rule changes history](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/detect-and-alert/view-rule-changes-history). ## Next steps - [Find out how hunts pass detection gaps](/elastic/docs-content/pull/9157/solutions/security/alertzero/act-on-hunt-finding#alertzero-hunt-finding-outcomes) to the Rule Coverage Worker. - [Find other work that Workers bring you](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/work-in-alertzero).