AlertZero
AlertZero is the agentic layer of Elastic Security. Its Workers are AI agents that triage alerts, hunt for threats, tune detection rules, and investigate attacks on a schedule, so your team spends less time sorting through noise and more time on the decisions that need a person.
When a step needs a person, such as closing alerts, isolating a host, or changing a detection rule, a Worker brings it to you as a proposed action on the Proposed actions page. Each proposed action comes with an investigation that holds the Worker's evidence and conclusion, so you can check its reasoning before you approve or decline instead of redoing the work.
Workers are grouped into four Watches, one for each area of security operations. The Watches pass work to each other, so a finding in one area can lead to action in another.
| Watch | What it does | Workers |
|---|---|---|
| Triage Watch | Classifies new alerts, proposes closing false positives, and groups related alerts into attacks, so you review proposed actions instead of individual alerts. | Alert Triage, Attack Discovery |
| Hunt Watch | Hunts your data for activity described in threat reports that your detection rules might have missed, so you have fewer blind spots. | Continuous Threat Hunt |
| Detection Watch | Tunes noisy rules to cut false positives, and proposes turning on an existing rule, installing a prebuilt rule, or creating a new one to cover gaps in your detections. | Rule Tuning, Rule Coverage |
| Forensics Watch | Investigates attacks and proposes response actions, such as isolating a host. | Endpoint Analysis |
Every Worker starts at Manual autonomy, so each proposed action waits for your approval. You can raise the level for some Workers. A Worker approves its own proposed actions only at Supervised, and changes to detection rules always wait for you.
To change a Worker's level, or to check what it does at each level, open the Worker's Watch on the Watches page.
Workers can add to your bill in three ways:
- Workflow executions: Workers run as workflows, so each run counts as a workflow execution.
- Elastic Agent Builder executions: When a Worker asks an AI agent to analyze its findings, each agent response counts as an Elastic Agent Builder execution.
- AI model tokens: If the space uses an Elastic Managed LLM, Elastic bills its model calls by token. Third-party model providers bill you directly.
AlertZero is off by default, and you turn it on separately in each space. To start, turn on the AlertZero setting in Advanced Settings, then select AlertZero in the navigation menu and follow the onboarding steps.