Respond to an attack

The Attack Discovery Worker opens an investigation for each potential attack it finds, and then judges whether the attack is real. For each attack that it confirms or can't rule out, its autonomy controls what happens next:

  • With Manual autonomy (the default), the Worker proposes sending the attack for forensics and waits for you to approve or decline it.
  • With Supervised autonomy, the Worker sends the attack for forensics on its own. You check what ran afterward.

In forensics, the Endpoint Analysis Worker analyzes the affected host, reports what happened on it, and proposes response actions, such as isolating the host. An incident responder usually takes over from there to decide each response action and whether to close the investigation.

The Attack Discovery Worker gives each attack a verdict, and the verdict decides what AlertZero does:

  • True positive or inconclusive: Depending on its autonomy, the Worker proposes sending the attack for forensics or sends it on its own.
  • False positive: AlertZero closes the investigation and the attack without asking you, and marks the attack's open alerts as acknowledged.
  • Analysis failed: The investigation stays open with no proposed actions. Review the attack yourself.

Open the attack on the Proposed actions page, and check the verdict and the reasoning behind it. Then approve or decline sending the attack for forensics:

  • If you approve: The Endpoint Analysis Worker analyzes the attack and proposes response actions. The investigation and the attack stay open for the forensics report. You can't undo this approval.
  • If you decline: The investigation and the attack close. AlertZero marks the attack's open alerts as acknowledged, but doesn't close them.

If the proposed action expires before anyone decides, the investigation stays open.

The Endpoint Analysis Worker analyzes one host per attack. It picks the host that the attack names or, if the attack names none, the host that appears most often in the attack's alerts. Then it searches that host's Elastic Defend data from around the time of the attack. If the host has no Elastic Defend data from that time, the Worker doesn't run, and no report appears. Close the investigation yourself.

The Worker writes what it finds into a forensics report. When the report shows malicious activity on the host, the Worker also proposes response actions. It picks the most specific action that the evidence in the report supports:

  • Kill or suspend a process: When the evidence identifies the process, such as by its process ID.
  • Isolate the host: When the evidence identifies the host, but not a specific process.

If the evidence doesn't identify the host or process that an action needs, the Worker doesn't propose that action.

The forensics report in the investigation's details shows what the attack did on the host:

  • Forensic timeline: The attack's events on the host, in order.
  • IOCs: The indicators of compromise that the Endpoint Analysis Worker found, such as file hashes, IP addresses, file paths, command lines, and affected identities.

Because the report covers only one host, check whether its IOCs appear on your other hosts to find out which ones the attack reached.

On the Proposed actions page, an attack's response actions belong to the investigation named after the attack. Each one explains the evidence it rests on and what it stops. Check which host or process it targets, and make sure the forensics report implicates it. Consider what stops working when you act on it. For example, isolating a server also cuts off the people and services that depend on it. Then approve or decline the action:

  • If you approve: The action runs under your account, through Elastic Defend, so you need the privileges to run it. If you don't have them, or the host doesn't respond within 10 minutes, the action fails, and AlertZero offers it again as a new proposed action with the same deadline. The Elastic Defend action might still run when the host comes back online, so check the response actions history before you approve it again.
  • If you decline: The action doesn't run. The same happens if the proposed action expires before anyone decides.

If you isolate a host, AlertZero doesn't propose releasing it later. When it's safe to reconnect the host, release it yourself. You can't undo the other response actions.

Your team can set either Worker to Supervised autonomy, so the Worker acts without waiting for you:

  • Attack Discovery Worker: Sends attacks for forensics without asking.
  • Endpoint Analysis Worker: Runs its response actions without asking.

To see which response actions ran, check Closed Actions on the Proposed actions page for actions that the Endpoint Analysis Worker approved, or check the response actions history. If the Endpoint Analysis Worker isolated a host and it's safe to reconnect the host, release it.

When no response actions are waiting for a decision, the Endpoint Analysis Worker proposes closing the investigation. This proposed action always waits for you, even when the Workers run at Supervised autonomy.

  • If you approve: The investigation, the attack, and its alerts close. Alerts that another open attack also includes stay open.
  • If you decline: Everything stays open. AlertZero asks again after you decide the next proposed action in the investigation.

To work on the attack with other people instead, escalate the investigation.