--- title: AlertZero glossary description: Reference of terms used across AlertZero documentation, with links to the pages that explain them. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/glossary products: - Elastic Cloud Serverless - Elastic Documentation - Elastic Security applies_to: - Serverless Security projects: Preview - Elastic Stack: Planned --- # AlertZero glossary This glossary defines the terms you see in AlertZero and its documentation. Each entry links to the page that explains it in more detail, where one exists. ## A-B ### AlertZero The agentic layer of Elastic Security. AI-powered [Workers](#alertzero-glossary-worker), grouped into [Watches](#alertzero-glossary-watch), triage alerts, hunt for threats, tune detection rules, and investigate attacks, then bring you the [proposed actions](#alertzero-glossary-proposed-action) that need a person to decide. Refer to [AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero). ### Assisted (autonomy) An [autonomy](#alertzero-glossary-autonomy) level at which a Worker starts its analysis on its own, without asking you first, but still waits for your approval before it makes any change. For example, Rule Tuning analyzes a noisy rule on its own and drafts a tuning change, then waits for you to approve the change. Refer to [Configure Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/configure-worker-settings). ### Attack Discovery An Elastic Security feature that uses large language models (LLMs) to group related alerts into attack narratives. In AlertZero, Attack Discovery is also the name of a [Worker](#alertzero-glossary-worker) in the [Triage Watch](#alertzero-glossary-triage-watch). It runs on a schedule, opens an [investigation](#alertzero-glossary-investigation) for each candidate attack, and proposes handing attacks it confirms, or can't rule out, to the [Forensics Watch](#alertzero-glossary-forensics-watch). Refer to [Attack Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/ai/attack-discovery) and [Watches and Workers > Triage Watch](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-triage-watch). ### Autonomy A Worker setting that controls how far the Worker goes on its own before it waits for a person. Each Worker offers some of these levels: [Manual](#alertzero-glossary-manual), [Assisted](#alertzero-glossary-assisted), and [Supervised](#alertzero-glossary-supervised). Every Worker starts at Manual. Refer to [Configure Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/configure-worker-settings). ### Balanced models A model setting in **Feature Settings** for AlertZero calls where accuracy matters, but that run often or use tools over many steps, such as triaging alerts or diagnosing a noisy rule. Choose a strong mid-size model. Refer to [Efficient models](#alertzero-glossary-efficient-models) and [Frontier models](#alertzero-glossary-frontier-models). ## C-D ### Cyber domain models An optional model setting in **Feature Settings** for cyber-specific models. A model you save here replaces the [Efficient](#alertzero-glossary-efficient-models) or [Frontier](#alertzero-glossary-frontier-models) model that Attack Discovery and alert triage calls would otherwise use. If you leave it empty, those calls keep using their usual models. ### Detection Watch The [Watch](#alertzero-glossary-watch) that handles detection engineering, improving your detection rules at the source instead of handling the alerts they produce one by one. Its Rule Tuning Worker diagnoses noisy or under-covering rules and proposes tuning changes. Its Rule Coverage Worker assesses detection gaps that the Hunt Watch finds and proposes new or existing rules to close them. Refer to [Watches and Workers > Detection Watch](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-detection-watch). ## E-F ### Efficient models A model setting in **Feature Settings** for AlertZero calls that need quick, lightweight judgment and run often, such as checking detection coverage. Choose a small, low-cost model. Refer to [Balanced models](#alertzero-glossary-balanced-models) and [Frontier models](#alertzero-glossary-frontier-models). ### Escalation A coordinated response that you create from an [investigation](#alertzero-glossary-investigation) to work on it with other people, privately if needed. An escalation can link related investigations, and it has an owner, assignees, and a visibility of **Public** or **Private**. Closing an escalation also closes its linked investigations. Refer to [Escalate an investigation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/escalate-investigation) and [Track escalations](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/track-escalations). ### Forensics Watch The [Watch](#alertzero-glossary-watch) that does deep research on threats and exploits, running forensics on an attack. Its Endpoint Analysis Worker reconstructs the attack timeline on the affected hosts and proposes response actions. It runs only on attacks handed off by the Attack Discovery Worker, and it needs Elastic Defend data. Refer to [Watches and Workers > Forensics Watch](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-forensics-watch). ### Frontier models A model setting in **Feature Settings** for complex, single-pass AlertZero work where output quality matters most, such as generating attack discoveries or drafting a detection rule. Choose your most capable model. Refer to [Efficient models](#alertzero-glossary-efficient-models) and [Balanced models](#alertzero-glossary-balanced-models). ## H-I ### Hunt finding A result from the [Hunt Watch](#alertzero-glossary-hunt-watch): activity in your environment that matches a [threat report](#alertzero-glossary-threat-report). Each hunt finding opens an [investigation](#alertzero-glossary-investigation) and shows its supporting evidence, such as matching events, indicators, and techniques. In an investigation, a hunt finding appears as a **Significant Security Event**. Refer to [Act on a hunt finding](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/act-on-hunt-finding). ### Hunt Watch The [Watch](#alertzero-glossary-watch) that proactively hunts your environment for threats, without waiting for an alert. Its Continuous Threat Hunt Worker searches your data for activity that matches threat reports and for detection coverage gaps. This Worker runs on a fixed schedule and always uses [Manual](#alertzero-glossary-manual) autonomy. Refer to [Watches and Workers > Hunt Watch](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-hunt-watch). ### Investigation A record of an AlertZero Worker's inquiry into a potential threat, such as a candidate attack or a [hunt finding](#alertzero-glossary-hunt-finding). An investigation collects the Worker's evidence, its conclusion, and any [proposed actions](#alertzero-glossary-proposed-action). You can assign an investigation, close it, or [escalate](#alertzero-glossary-escalation) it. Refer to [Escalate an investigation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/escalate-investigation). ## M-P ### Manual (autonomy) The default [autonomy](#alertzero-glossary-autonomy) level. At this level, every action the Worker proposes waits for your approval, and some Workers also ask for your approval before they start analyzing. For example, Alert Triage waits for you to approve closing false-positive alerts, Attack Discovery waits for you to approve handing an attack to the Forensics Watch, and Endpoint Analysis waits for you to approve each response action. Refer to [Configure Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/configure-worker-settings). ### Proposed action A recommendation from a Worker that waits for your decision, such as closing false-positive alerts, isolating a host, or changing a detection rule. You review the details, then approve or decline it. Depending on the Worker's [autonomy](#alertzero-glossary-autonomy) level, some proposed actions run without waiting for you. Statuses include **Needs review**, **Applying**, **Applied**, **Declined**, **Failed**, and **Expired**. Refer to [Decide a proposed action](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/decide-proposed-action). ## R-S ### Supervised (autonomy) The highest [autonomy](#alertzero-glossary-autonomy) level. At this level, the Worker approves its own proposed actions instead of waiting for you, and you review the results afterward. For example, Alert Triage closes false-positive alerts, which you can reopen, Attack Discovery hands attacks to the Forensics Watch, and Endpoint Analysis runs its response actions. Refer to [Configure Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/configure-worker-settings). ## T-W ### Threat intel supply The set of workflows that feed threat intelligence to the [Hunt Watch](#alertzero-glossary-hunt-watch). **Ingest** collects threat feeds, **Enrich** builds out threat reports, and **Attribute alerts to reports** connects alerts to those reports. AlertZero turns them on when you turn on the Continuous Threat Hunt Worker, and off again when you turn it off. Ingest and Enrich are shared across all spaces. Refer to [Configure Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/configure-worker-settings). ### Threat report A report of threat activity, built from ingested threat intelligence, that the [Hunt Watch](#alertzero-glossary-hunt-watch) searches your data for. A [hunt finding](#alertzero-glossary-hunt-finding) links back to its source report. ### Triage Watch The [Watch](#alertzero-glossary-watch) that works as your first line of defense, reviewing incoming alerts and routing the ones that still need a person. Its Alert Triage Worker classifies alerts as true or false positives, then proposes closing the false positives. Its Attack Discovery Worker finds candidate attacks and opens an investigation for each. Refer to [Watches and Workers > Triage Watch](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-triage-watch). ### Watch A named group of [Workers](#alertzero-glossary-worker) with one area of expertise. AlertZero includes the following Watches: [Triage Watch](#alertzero-glossary-triage-watch), [Hunt Watch](#alertzero-glossary-hunt-watch), [Detection Watch](#alertzero-glossary-detection-watch), and [Forensics Watch](#alertzero-glossary-forensics-watch). Each Watch has its own page where you turn its Workers on or off and change their settings. Refer to [Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers). ### Worker An AI-powered unit of work that belongs to a [Watch](#alertzero-glossary-watch). A Worker runs in the background, either on a schedule or in response to events such as new alerts. It analyzes your data and brings you [proposed actions](#alertzero-glossary-proposed-action). Each Worker has its own settings, including whether it's turned on, its trigger, and its [autonomy](#alertzero-glossary-autonomy) level. Refer to [Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers) and [Configure Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/configure-worker-settings). ## Related - [AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero): What AlertZero is and how its parts fit together. - [Watches and Workers](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers): Reference for every Watch and Worker. - [Use AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/use-alertzero): Read the AlertZero home page and decide on proposed actions. - [Manage AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/manage-alertzero): What you can and can't configure in AlertZero.