AlertZero glossary

This glossary defines the terms you see in AlertZero and its documentation. Each entry links to the page that explains it in more detail, where one exists.

The agentic layer of Elastic Security. AI-powered Workers, grouped into Watches, triage alerts, hunt for threats, tune detection rules, and investigate attacks, then bring you the proposed actions that need a person to decide. Refer to AlertZero.

An autonomy level at which a Worker starts its analysis on its own, without asking you first, but still waits for your approval before it makes any change. For example, Rule Tuning analyzes a noisy rule on its own and drafts a tuning change, then waits for you to approve the change. Refer to Configure Worker settings.

An Elastic Security feature that uses large language models (LLMs) to group related alerts into attack narratives. In AlertZero, Attack Discovery is also the name of a Worker in the Triage Watch. It runs on a schedule, opens an investigation for each candidate attack, and proposes handing attacks it confirms, or can't rule out, to the Forensics Watch. Refer to Attack Discovery and Watches and Workers > Triage Watch.

A Worker setting that controls how far the Worker goes on its own before it waits for a person. Each Worker offers some of these levels: Manual, Assisted, and Supervised. Every Worker starts at Manual. Refer to Configure Worker settings.

A model setting in Feature Settings for AlertZero calls where accuracy matters, but that run often or use tools over many steps, such as triaging alerts or diagnosing a noisy rule. Choose a strong mid-size model. Refer to Efficient models and Frontier models.

An optional model setting in Feature Settings for cyber-specific models. A model you save here replaces the Efficient or Frontier model that Attack Discovery and alert triage calls would otherwise use. If you leave it empty, those calls keep using their usual models.

The Watch that handles detection engineering, improving your detection rules at the source instead of handling the alerts they produce one by one. Its Rule Tuning Worker diagnoses noisy or under-covering rules and proposes tuning changes. Its Rule Coverage Worker assesses detection gaps that the Hunt Watch finds and proposes new or existing rules to close them. Refer to Watches and Workers > Detection Watch.

A model setting in Feature Settings for AlertZero calls that need quick, lightweight judgment and run often, such as checking detection coverage. Choose a small, low-cost model. Refer to Balanced models and Frontier models.

A coordinated response that you create from an investigation to work on it with other people, privately if needed. An escalation can link related investigations, and it has an owner, assignees, and a visibility of Public or Private. Closing an escalation also closes its linked investigations. Refer to Escalate an investigation and Track escalations.

The Watch that does deep research on threats and exploits, running forensics on an attack. Its Endpoint Analysis Worker reconstructs the attack timeline on the affected hosts and proposes response actions. It runs only on attacks handed off by the Attack Discovery Worker, and it needs Elastic Defend data. Refer to Watches and Workers > Forensics Watch.

A model setting in Feature Settings for complex, single-pass AlertZero work where output quality matters most, such as generating attack discoveries or drafting a detection rule. Choose your most capable model. Refer to Efficient models and Balanced models.

A result from the Hunt Watch: activity in your environment that matches a threat report. Each hunt finding opens an investigation and shows its supporting evidence, such as matching events, indicators, and techniques. In an investigation, a hunt finding appears as a Significant Security Event. Refer to Act on a hunt finding.

The Watch that proactively hunts your environment for threats, without waiting for an alert. Its Continuous Threat Hunt Worker searches your data for activity that matches threat reports and for detection coverage gaps. This Worker runs on a fixed schedule and always uses Manual autonomy. Refer to Watches and Workers > Hunt Watch.

A record of an AlertZero Worker's inquiry into a potential threat, such as a candidate attack or a hunt finding. An investigation collects the Worker's evidence, its conclusion, and any proposed actions. You can assign an investigation, close it, or escalate it. Refer to Escalate an investigation.

The default autonomy level. At this level, every action the Worker proposes waits for your approval, and some Workers also ask for your approval before they start analyzing. For example, Alert Triage waits for you to approve closing false-positive alerts, Attack Discovery waits for you to approve handing an attack to the Forensics Watch, and Endpoint Analysis waits for you to approve each response action. Refer to Configure Worker settings.

A recommendation from a Worker that waits for your decision, such as closing false-positive alerts, isolating a host, or changing a detection rule. You review the details, then approve or decline it. Depending on the Worker's autonomy level, some proposed actions run without waiting for you. Statuses include Needs review, Applying, Applied, Declined, Failed, and Expired. Refer to Work in AlertZero.

The highest autonomy level. At this level, the Worker approves its own proposed actions instead of waiting for you, and you review the results afterward. For example, Alert Triage closes false-positive alerts, which you can reopen, Attack Discovery hands attacks to the Forensics Watch, and Endpoint Analysis runs its response actions. Refer to Configure Worker settings.

The set of workflows that feed threat intelligence to the Hunt Watch. Ingest collects threat feeds, Enrich builds out threat reports, and Attribute alerts to reports connects alerts to those reports. AlertZero turns them on when you turn on the Continuous Threat Hunt Worker, and off again when you turn it off. Ingest and Enrich are shared across all spaces. Refer to Configure Worker settings.

A report of threat activity, built from ingested threat intelligence, that the Hunt Watch searches your data for. A hunt finding links back to its source report.

The Watch that works as your first line of defense, reviewing incoming alerts and routing the ones that still need a person. Its Alert Triage Worker classifies alerts as true or false positives, then proposes closing the false positives. Its Attack Discovery Worker finds candidate attacks and opens an investigation for each. Refer to Watches and Workers > Triage Watch.

A named group of Workers with one area of expertise. AlertZero includes the following Watches: Triage Watch, Hunt Watch, Detection Watch, and Forensics Watch. Each Watch has its own page where you turn its Workers on or off and change their settings. Refer to Watches and Workers.

An AI-powered unit of work that belongs to a Watch. A Worker runs in the background, either on a schedule or in response to events such as new alerts. It analyzes your data and brings you proposed actions. Each Worker has its own settings, including whether it's turned on, its trigger, and its autonomy level. Refer to Watches and Workers and Configure Worker settings.