---
title: Grant access to AlertZero
description: Give each person on your team the AlertZero access their work needs in Elastic Security, with a serverless predefined role or a custom role for analysts and administrators.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/alertzero-privileges
products:
- Elastic Cloud Serverless
- Elastic Documentation
- Elastic Security
applies_to:
- Serverless Security projects: Preview
- Elastic Stack: Planned
---
# Grant access to AlertZero
Give each person on your team only the AlertZero access their work needs, whether they view AlertZero, approve or decline proposed actions, or set up Workers.
Most AlertZero access comes from the **AlertZero**, **Proposed Actions**, and **Agentic Investigations** [Kibana privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges). A [predefined role](#alertzero-assign-predefined-role) already includes these privileges, so it's the quickest way to give someone access. To grant narrower access, [build a custom role](#alertzero-build-custom-role) with the privileges for each job.
## Assign a predefined role
To approve an action, a role also needs the [privileges to run that action](#alertzero-action-privileges).
### Serverless predefined roles
- Elastic Cloud Serverless: Preview
- Elastic Stack: Unavailable
In Serverless, assign one of these [predefined roles](/elastic/docs-content/pull/9158/deploy-manage/users-roles/cloud-organization/user-roles#general-assign-user-roles-table):
| Predefined roles | What they can do in AlertZero |
|---------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| - Admin | - Everything, including turning Workers on or off and changing their settings |
| - Editor- SOC manager- Tier 3 analyst- Rule author- Detections admin- Platform engineer | - Approve or decline proposed actions- Manage investigations- Manage escalations- Start onboarding, but not turn on Workers |
| - Tier 1 analyst- Tier 2 analyst- Threat intelligence analyst- Endpoint operations analyst- Endpoint policy manager | - Approve or decline proposed actions- Manage investigations- Manage escalations |
| - Viewer | - View AlertZero without making changes |
### Elastic Stack built-in roles
- Elastic Cloud Serverless: Unavailable
- Elastic Stack: Planned
On Elastic Stack, assign one of these [built-in roles](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/elasticsearch/roles):
| Built-in role | What they can do in AlertZero |
|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| superuser | - Everything, including turning Workers on or off and changing their settings |
| editor | - Approve or decline proposed actions. To approve host isolation and process actions, they also need the [Elastic Defend privileges](#alertzero-action-privileges).- Manage investigations- View escalations, but not open, assign, or link them- Turn on AlertZero in a space and start onboarding, but not turn on Workers |
| viewer | - View AlertZero without making changes |
## Build a custom role
To create the role, refer to [Kibana role management](/elastic/docs-content/pull/9158/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management#adding_kibana_privileges).
### Let analysts review proposed actions and investigations
Every analyst needs the privileges in the first row. Add the privileges in the other rows for each task the analyst does.
| To let someone | Add |
|-----------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|
| View AlertZero, its Watch settings, and the **Proposed actions** page | **AlertZero**: **Read** and **Proposed Actions**: **Read** |
| Approve or decline proposed actions | **Proposed Actions**: **All**, plus the [privileges for each action](#alertzero-action-privileges) they approve |
| See impacted entities, and filter proposed actions by entity | **Agentic Investigations**: **Read** |
| Open investigation details or chats | **Agent Builder**: **Read** |
| Assign, close, or reopen investigations | **Agentic Investigations**: **All**, or its **Manage investigations** sub-feature privilege |
### Let analysts work on escalations
Add the privileges for each task the analyst does with escalations.
| To let someone | Add |
|-------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| View escalations | **Agentic Investigations**: **Read**, or its **View escalations** sub-feature privilege |
| Open escalation details or chats | **Agent Builder**: **Read** |
| Create an escalation, add an investigation to one, or change who is assigned to one | **Agentic Investigations**: **Manage escalations** sub-feature privilege, which **All** doesn't include |
| Close an escalation | **Agentic Investigations**: **Manage escalations** and **Manage investigations** sub-feature privileges. To close an escalation that has pending proposed actions, also add **Proposed Actions**: **All**. |
### Let analysts run the actions they approve
An approved action runs as the person who approved it, so each analyst needs the privileges for the actions they approve. Without them, the action fails.
| Action | Privileges |
|-----------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Close alerts | **Alerts**: **All** |
| Create, edit, install, or turn on a detection rule, or add a rule exception | **Rules and Exceptions**: **All** |
| Isolate a host | **Security**: **All**, with the [Elastic Defend sub-feature privileges](/elastic/docs-content/pull/9158/solutions/security/configure-elastic-defend/elastic-defend-feature-privileges#response-actions) **Host Isolation** and **Response Actions History** |
| Kill or suspend a process | **Security**: **All**, with the [Elastic Defend sub-feature privileges](/elastic/docs-content/pull/9158/solutions/security/configure-elastic-defend/elastic-defend-feature-privileges#response-actions) **Process Operations** and **Response Actions History** |
A detection rule that an analyst creates, changes, installs, or turns on by approving an action runs with that analyst's privileges. The same [rule authorization](/elastic/docs-content/pull/9158/solutions/security/detect-and-alert/detection-rule-concepts#rule-authorization-concept) applies after any rule edit.
At Supervised autonomy, a Worker approves its own proposed actions, and they run as the Worker's [service account](#alertzero-worker-privileges). Analysts don't need the action privileges for those actions.
### Let administrators set up and manage Workers
To [set up AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/set-up-alertzero) in a space, an administrator needs the privileges in the first three rows. Add the privileges in the other rows for each task the administrator does after setup.
| To let someone | The role needs |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Turn on AlertZero in a space | **Advanced Settings**: **All** |
| Start AlertZero onboarding | **AlertZero**: **All** |
| Turn Workers on or off | **AlertZero**: **All**, the `manage_security` cluster privilege, and **Workflows**: **Update** and **Update managed workflows**, which **All** doesn't include. Each Worker runs as a [managed workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/explore-analyze/workflows/managed-workflows). |
| Change the models the Workers use | The [privileges for **Feature Settings**](/elastic/docs-content/pull/9158/explore-analyze/ai-features/manage-access-to-ai-assistant#requirements) |
| Edit Worker settings, such as autonomy | **AlertZero**: **All** and the `manage_security` cluster privilege |
| [Run Workers on demand](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/run-worker-on-demand) from Workflows | **Workflows**: **Execute** |
| [View Worker execution history](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/view-execution-history) | **Workflows**: **Read**, or its **Read Workflow Execution** and **Read managed workflow execution** sub-feature privileges |
AlertZero uses the `manage_security` cluster privilege to create a [service account](#alertzero-worker-privileges) for each Worker. The privilege also lets anyone who has it manage users and roles for the whole cluster, so don't grant it only for AlertZero. Instead, have an administrator who already has it set up the Workers.
## Privileges the Workers run with
Each Worker runs as its own service account with a built-in role of the same name, such as `alertzero_alert_triage` for Alert Triage. In Serverless, the role name starts with an underscore, such as `_alertzero_alert_triage`. You can't edit or delete these roles.
AlertZero creates the service accounts with the privileges of the person who turns on the Workers.