---
title: Set up AlertZero
description: Set up AlertZero in an Elastic Security space: check what each Worker needs, turn on AlertZero, select models, and start the Workers.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/set-up-alertzero
products:
- Elastic Cloud Serverless
- Elastic Documentation
- Elastic Security
applies_to:
- Serverless Security projects: Preview
- Elastic Stack: Planned
---
# Set up AlertZero
To use AlertZero in an Elastic Security space, turn it on, select the models the Workers use, and start the Workers. AlertZero is off by default, so repeat this setup in each space.
To use AlertZero, you need a subscription that includes it. For the features in each subscription tier, refer to the subscription pages for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack and self-managed deployments](https://www.elastic.co/subscriptions).
## Before you begin
### Required for all Workers
Before you start the Workers, make sure you have all the following:
- A role with the [privileges to set up AlertZero](/elastic/docs-content/pull/9158/solutions/security/alertzero/alertzero-privileges#alertzero-admin-access).
- An AI model in the space, either an [Elastic Managed LLM](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana/elastic-managed-llm) or an [external inference endpoint](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/explore-analyze/elastic-inference/external) for a third-party model provider. If your subscription includes Elastic Managed LLMs, they're available by default. To change which models the Workers use, refer to [Select models for the Workers](#alertzero-choose-models).
- Events and alerts in Elastic Security for the Workers to analyze. If you don't have them yet, [ingest data](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/get-started/ingest-data-to-elastic-security) into Elastic Security, then [turn on detections](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/detect-and-alert/turn-on-detections) and [install and enable prebuilt rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/detect-and-alert/install-prebuilt-rules) so that your data generates alerts.
### Required for specific Workers
Check what each Worker you plan to run needs:
| Worker | Analyzes | Requirements |
|---------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Alert Triage](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-triage-watch) | Detection alerts waiting for triage | [Alert analysis workflow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/explore-analyze/workflows/use-cases/security/automate-security-operations/alert-analysis-workflow) turned on |
| [Attack Discovery](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-triage-watch) | Detection alerts | **Attack Discovery Workflows** [advanced setting](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/advanced-settings#kibana-siem-settings) turned on, and [Context Engine](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/explore-analyze/ai-features/context-engine) to hand off attacks |
| [Continuous Threat Hunt](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-hunt-watch) | Events in the default [Elastic Security indices](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/advanced-settings#kibana-siem-settings), such as `logs-*` | Context Engine, outbound HTTPS access to the [threat feeds](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-hunt-watch), [models](#alertzero-choose-models) in the default space, and a [default embedding endpoint](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/elasticsearch/mapping-reference/semantic-text-setup-configuration#default-endpoints) |
| [Rule Tuning](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-detection-watch) | Alerts marked as false positives | None |
| [Rule Coverage](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-detection-watch) | Detection gaps from Continuous Threat Hunt | Continuous Threat Hunt and Context Engine |
| [Endpoint Analysis](/elastic/docs-content/pull/9158/solutions/security/alertzero/watches-and-workers#alertzero-forensics-watch) | Attacks handed off by Attack Discovery | Attack Discovery, Elastic Defend, and Context Engine |
## Turn on AlertZero for a space
In the space where you want AlertZero, open **Advanced Settings**, turn on the **AlertZero** setting (`securitySolution:enableAlertZero`), save your changes, and reload Kibana. AlertZero then appears in the Elastic Security navigation menu.
## Select models for the Workers
The Workers match each model call to a model tier based on what the call needs. Each tier has its own list of models in the **AlertZero** section of [Feature Settings](/elastic/docs-content/pull/9158/explore-analyze/ai-features/manage-access-to-ai-assistant#feature-settings):
- **Efficient models**: Quick, lightweight calls that run often, such as checking detection coverage.
- **Balanced models**: Calls where accuracy matters, but that run often or use tools over many steps, such as triaging alerts or diagnosing a noisy rule.
- **Frontier models**: Complex work where output quality matters most, such as generating attack discoveries or drafting a detection rule.
Each tier starts with its own preset models instead of your default model, and the Workers use the first available model in the tier's list. To use a different model for a tier, add it to the tier's list in the **AlertZero** section of **Feature Settings**, and move it to the top or remove the models listed before it. Do this before you [start the Workers](#alertzero-turn-on-workers), because their first run starts right away.
To run every Worker on your default model instead, turn off **Feature specific models**.
### Run Workers on OpenAI Daybreak models
The optional **Cyber domain models** tier is for OpenAI Daybreak models, which are designed for cybersecurity tasks. You don't need to apply to OpenAI's Trusted Access for Cyber program to use them in AlertZero.
Daybreak models are available only through the [Elastic Inference Service (EIS)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/explore-analyze/elastic-inference/eis), and [standard EIS pricing](/elastic/docs-content/pull/9158/explore-analyze/elastic-inference/eis#pricing) applies. The tier stays empty until the models are available on EIS. OpenAI restricts their use to AlertZero, so they don't appear in other model lists, and you can't chat with them directly.
A Daybreak model in the **Cyber domain models** tier replaces the other tiers for the Alert Triage, Attack Discovery, and Continuous Threat Hunt Workers. The one exception is ES|QL queries. Continuous Threat Hunt can't use a Daybreak model to write them, so it keeps using **Frontier models** for those queries.
## Start the Workers
Open **AlertZero** in the navigation menu to start onboarding. Every Worker starts out on, so turn off any that you don't plan to run. At least one Worker must stay on. If a Worker needs a setting that's off, such as Context Engine, onboarding lets you turn it on, and it links to setup for dependencies such as Elastic Defend.
When you finish onboarding, the Workers start their first run right away, and AlertZero opens the **Proposed actions** page. When a Worker needs your decision, its proposed action appears there.
To change which Workers run after setup, or the default Worker settings, refer to [Configure Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/configure-worker-settings).
## Next steps
- [Give your team access to AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/alertzero-privileges) so they can review and decide proposed actions.
- [Find the proposed actions that need your decision](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/use-alertzero).
- [Change Worker settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9158/solutions/security/alertzero/configure-worker-settings), such as autonomy and schedule.