---
title: Work in AlertZero
description: Find the work that AlertZero Workers bring you in Elastic Security, see which proposed actions fit your role, and follow up on investigations and escalations.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/work-in-alertzero
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Work in AlertZero
Workers do the analysis, and you decide what they bring you, such as which alerts to close, how to contain an attack, and which detection rules to change. When the investigation behind a decision needs more work, you can hand it to a teammate or escalate it.
Each kind of work waits in its own section of the **Proposed actions** page:
- **Investigate:** Alert closures, attacks to send for forensics, and memory dumps.
- **Respond:** Response actions, analyst recommendations, and the proposed action that closes an attack's investigation.
- **Configure:** Detection rule changes.

Each proposed action expires 72 hours after a Worker proposes it. If nobody decides before then, the action doesn't run, and the proposed action shows **Expired**.

## Find the work that fits your role


| Your goal                                                            | Start here                                                                                                                                                          |
|----------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Clear false positives out of your open alerts                        | [Close false-positive alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/close-false-positive-alerts)          |
| Take an attack from verdict to containment                           | [Respond to an attack](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/respond-to-attack)                           |
| Act on what a threat hunt found                                      | [Act on a hunt finding](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/act-on-hunt-finding)                        |
| Review proposed rule changes and new rules                           | [Tune noisy rules and fill detection gaps](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/decide-detection-change) |
| Ask follow-up questions about the evidence                           | Select **Open in chat** on the card                                                                                                                                 |
| Focus on one host, user, or service                                  | Select it in **Impacted entities**                                                                                                                                  |
| Hand off the investigation or coordinate a response                  | Assign it from its card, or [escalate it](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9157/solutions/security/alertzero/escalate-investigation)   |
| Close the investigation and dismiss all its pending proposed actions | Select **Close investigation** on its card                                                                                                                          |
| Audit recent decisions, including ones Workers made on their own     | Expand **Closed Actions**, which lists decisions from the last 72 hours. A decision that a Worker made on its own names the Worker that made it.                    |