Set up AlertZero

To use AlertZero in an Elastic Security space, turn it on, select the models the Workers use, and start the Workers. AlertZero is off by default, so repeat this setup in each space.

Note

To use AlertZero, you need a subscription that includes it. For the features in each subscription tier, refer to the subscription pages for Elastic Cloud and Elastic Stack and self-managed deployments.

Before you start the Workers, make sure you have all the following:

Check what each Worker you plan to run needs:

Worker Analyzes Requirements
Alert Triage Detection alerts waiting for triage Alert analysis workflow turned on
Attack Discovery Detection alerts Attack Discovery Workflows advanced setting turned on, and Context Engine to hand off attacks
Continuous Threat Hunt Events in the default Elastic Security indices, such as logs-* Context Engine, outbound HTTPS access to the threat feeds, models in the default space, and a default embedding endpoint
Rule Tuning Alerts marked as false positives None
Rule Coverage Detection gaps from Continuous Threat Hunt Continuous Threat Hunt and Context Engine
Endpoint Analysis Attacks handed off by Attack Discovery Attack Discovery, Elastic Defend, and Context Engine

In the space where you want AlertZero, open Advanced Settings, turn on the AlertZero setting (securitySolution:enableAlertZero), save your changes, and reload Kibana. AlertZero then appears in the Elastic Security navigation menu.

The Workers match each model call to a model tier based on what the call needs. Each tier has its own list of models in the AlertZero section of Feature Settings:

  • Efficient models: Quick, lightweight calls that run often, such as checking detection coverage.
  • Balanced models: Calls where accuracy matters, but that run often or use tools over many steps, such as triaging alerts or diagnosing a noisy rule.
  • Frontier models: Complex work where output quality matters most, such as generating attack discoveries or drafting a detection rule.

Each tier starts with its own preset models instead of your default model, and the Workers use the first available model in the tier's list. To use a different model for a tier, add it to the tier's list in the AlertZero section of Feature Settings, and move it to the top or remove the models listed before it. Do this before you start the Workers, because their first run starts right away.

To run every Worker on your default model instead, turn off Feature specific models.

The optional Cyber domain models tier is for OpenAI Daybreak models, which are designed for cybersecurity tasks. You don't need to apply to OpenAI's Trusted Access for Cyber program to use them in AlertZero.

Daybreak models are available only through the Elastic Inference Service (EIS), and standard EIS pricing applies. The tier stays empty until the models are available on EIS. OpenAI restricts their use to AlertZero, so they don't appear in other model lists, and you can't chat with them directly.

Note

A Daybreak model in the Cyber domain models tier replaces the other tiers for the Alert Triage, Attack Discovery, and Continuous Threat Hunt Workers. The one exception is ES|QL queries. Continuous Threat Hunt can't use a Daybreak model to write them, so it keeps using Frontier models for those queries.

Open AlertZero in the navigation menu to start onboarding. Every Worker starts out on, so turn off any that you don't plan to run. At least one Worker must stay on. If a Worker needs a setting that's off, such as Context Engine, onboarding lets you turn it on, and it links to setup for dependencies such as Elastic Defend.

When you finish onboarding, the Workers start their first run right away, and AlertZero opens the Proposed actions page. When a Worker needs your decision, its proposed action appears there.

To change which Workers run after setup, or the default Worker settings, refer to Configure Worker settings.