Work in AlertZero
Workers do the analysis, and you decide what they bring you, such as which alerts to close, how to contain an attack, and which detection rules to change. When the investigation behind a decision needs more work, you can hand it to a teammate or escalate it.
Each kind of work waits in its own section of the Proposed actions page:
- Investigate: Alert closures, attacks to send for forensics, and memory dumps.
- Respond: Response actions, analyst recommendations, and the proposed action that closes an attack's investigation.
- Configure: Detection rule changes.
Each proposed action expires 72 hours after a Worker proposes it. If nobody decides before then, the action doesn't run, and the proposed action shows Expired.
| Your goal | Start here |
|---|---|
| Clear false positives out of your open alerts | Close false-positive alerts |
| Take an attack from verdict to containment | Respond to an attack |
| Act on what a threat hunt found | Act on a hunt finding |
| Review proposed rule changes and new rules | Tune noisy rules and fill detection gaps |
| Ask follow-up questions about the evidence | Select Open in chat on the card |
| Focus on one host, user, or service | Select it in Impacted entities |
| Hand off the investigation or coordinate a response | Assign it from its card, or escalate it |
| Close the investigation and dismiss all its pending proposed actions | Select Close investigation on its card |
| Audit recent decisions, including ones Workers made on their own | Expand Closed Actions, which lists decisions from the last 72 hours. A decision that a Worker made on its own names the Worker that made it. |