--- title: Respond to an attack description: Take an attack that AlertZero finds in Elastic Security from its Attack Discovery verdict to containment, with a forensics report and response actions from Endpoint Analysis. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/respond-to-attack products: - Elastic Cloud Serverless - Elastic Documentation - Elastic Security applies_to: - Serverless Security projects: Preview - Elastic Stack: Planned --- # Respond to an attack The Attack Discovery Worker opens an investigation for each potential attack it finds, and then judges whether the attack is real. For each attack that it confirms or can't rule out, its [autonomy](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/configure-worker-settings) controls what happens next: - With **Manual** autonomy (the default), the Worker proposes sending the attack for forensics and waits for you to [approve or decline](#alertzero-respond-handoff) it. - With **Supervised** autonomy, the Worker sends the attack for forensics on its own. You [check what ran](#alertzero-respond-autonomy) afterward. In forensics, the Endpoint Analysis Worker analyzes the affected host, reports what happened on it, and proposes response actions, such as isolating the host. An incident responder usually takes over from there to decide each response action and whether to close the investigation. ## How the Attack Discovery Worker judges an attack The Attack Discovery Worker gives each attack a verdict, and the verdict decides what AlertZero does: - **True positive or inconclusive:** Depending on its autonomy, the Worker proposes sending the attack for forensics or sends it on its own. - **False positive:** AlertZero closes the investigation and the attack without asking you, and marks the attack's open alerts as acknowledged. - **Analysis failed:** The investigation stays open with no proposed actions. Review the attack yourself. ## Decide whether to send the attack for forensics Open the attack on the **Proposed actions** page, and check the verdict and the reasoning behind it. Then approve or decline sending the attack for forensics: - **If you approve:** The Endpoint Analysis Worker analyzes the attack and proposes response actions. The investigation and the attack stay open for the forensics report. You can't undo this approval. - **If you decline:** The investigation and the attack close. AlertZero marks the attack's open alerts as acknowledged, but doesn't close them. If the proposed action [expires](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/work-in-alertzero) before anyone decides, the investigation stays open. ## How the Endpoint Analysis Worker analyzes an attack The Endpoint Analysis Worker analyzes one host per attack. It picks the host that the attack names or, if the attack names none, the host that appears most often in the attack's alerts. Then it searches that host's Elastic Defend data from around the time of the attack. If the host has no Elastic Defend data from that time, the Worker doesn't run, and no report appears. Close the investigation yourself. The Worker writes what it finds into a forensics report. When the report shows malicious activity on the host, the Worker also proposes response actions. It picks the most specific action that the evidence in the report supports: - **Kill or suspend a process:** When the evidence identifies the process, such as by its process ID. - **Isolate the host:** When the evidence identifies the host, but not a specific process. If the evidence doesn't identify the host or process that an action needs, the Worker doesn't propose that action. ## Read the forensics report The forensics report in the investigation's details shows what the attack did on the host: - **Forensic timeline:** The attack's events on the host, in order. - **IOCs:** The indicators of compromise that the Endpoint Analysis Worker found, such as file hashes, IP addresses, file paths, command lines, and affected identities. Because the report covers only one host, check whether its IOCs appear on your other hosts to find out which ones the attack reached. ## Decide each response action On the **Proposed actions** page, an attack's response actions belong to the investigation named after the attack. Each one explains the evidence it rests on and what it stops. Check which host or process it targets, and make sure the forensics report implicates it. Consider what stops working when you act on it. For example, isolating a server also cuts off the people and services that depend on it. Then approve or decline the action: - **If you approve:** The action runs under your account, through Elastic Defend, so you need the [privileges to run it](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/alertzero-privileges). If you don't have them, or the host doesn't respond within 10 minutes, the action fails, and AlertZero offers it again as a new proposed action with the same deadline. The Elastic Defend action might still run when the host comes back online, so check the [response actions history](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/endpoint-response-actions/response-actions-history) before you approve it again. - **If you decline:** The action doesn't run. The same happens if the proposed action [expires](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/work-in-alertzero) before anyone decides. If you isolate a host, AlertZero doesn't propose releasing it later. When it's safe to reconnect the host, [release it](/elastic/docs-content/pull/9157/solutions/security/endpoint-response-actions/isolate-host#release-a-host) yourself. You can't undo the other response actions. ## Check what ran without you Your team can set either Worker to Supervised autonomy, so the Worker acts without waiting for you: - **Attack Discovery Worker:** Sends attacks for forensics without asking. - **Endpoint Analysis Worker:** Runs its response actions without asking. To see which response actions ran, check **Closed Actions** on the **Proposed actions** page for actions that the Endpoint Analysis Worker approved, or check the [response actions history](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/endpoint-response-actions/response-actions-history). If the Endpoint Analysis Worker isolated a host and it's safe to reconnect the host, [release it](/elastic/docs-content/pull/9157/solutions/security/endpoint-response-actions/isolate-host#release-a-host). ## Close the investigation When no response actions are waiting for a decision, the Endpoint Analysis Worker proposes closing the investigation. This proposed action always waits for you, even when the Workers run at Supervised autonomy. - **If you approve:** The investigation, the attack, and its alerts close. Alerts that another open attack also includes stay open. - **If you decline:** Everything stays open. AlertZero asks again after you decide the next proposed action in the investigation. To work on the attack with other people instead, [escalate the investigation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/escalate-investigation). ## Next steps - [Find other work that Workers bring you](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/work-in-alertzero). - [Run response actions by hand](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/endpoint-response-actions). - [Learn how Attack Discovery finds attacks](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/ai/attack-discovery).