---
title: Escalate an investigation
description: Turn an AlertZero investigation into a coordinated response.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9184/solutions/security/alertzero/escalate-investigation
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Escalate an investigation
Escalate an investigation when you need to work on it with other people, whether to coordinate a broader response or to collaborate privately with a smaller group. An escalation brings related investigations together with their attachments, a summary, and assignees, and you choose who can see it.
You create each escalation yourself; AlertZero doesn't create them for you. When you create one, you become its owner, and only the owner can change its visibility later. Escalating an investigation doesn't close it or change its status, assignees, or contents. When you close the escalation, its linked open investigations close too.
<admonition title="Requirements">
  To create an escalation or add an investigation to one, your role needs specific privileges. Refer to [AlertZero privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9184/solutions/security/alertzero/alertzero-privileges).
</admonition>


## Create an escalation

1. Start from the investigation that you want to escalate:
   - On the **Proposed actions** page, find the investigation, select the actions menu `boxes_vertical`, then select **Open an escalation**.
   - If you already have the investigation open, select **Open an escalation** at the bottom of its details flyout.
2. In the **Escalate investigation** window, keep **Create escalation** selected.
3. (Optional) Edit the escalation title. It starts as the title of the investigation.
4. Choose who can see the escalation:
   - **Public**: Any user with the **Agent Builder: Read** or **Agent Builder: All** privilege can see it. This is the default. You're its only assignee until you add more.
   - **Private**: Only you and the people you add under **Who has access** can see it. You're listed as the owner and added as an assignee. Search for users and select any others you want to work with.
5. Select **Open escalation**.


## Add an investigation to an existing escalation

Link an investigation to an escalation that already exists when it belongs to the same response. The escalation then covers both.
1. On the **Proposed actions** page, find the investigation, select the actions menu `boxes_vertical`, then select **Attach to an escalation**.
   If you opened the investigation details flyout instead, select **Open an escalation** at the bottom of the flyout, and then select **Add to existing** in the **Escalate investigation** window.
2. Search for the escalation. The list shows open escalations, and each one shows how many investigations it links. An escalation is unavailable if the investigation is already linked to it, or if you don't own it and weren't added to it as a member of a private escalation. Hover over an unavailable escalation to see why.
3. Select the escalation, and then select **Add to escalation**.


## Next steps

- [Find the escalation and read its summary](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9184/solutions/security/alertzero/manage-escalations).
- [Work on the escalation with your team](/elastic/docs-content/pull/9184/solutions/security/alertzero/manage-escalations#manage-escalations-work).
- [Add or change assignees](/elastic/docs-content/pull/9184/solutions/security/alertzero/manage-escalations#manage-escalations-assignees).
- [Close the escalation](/elastic/docs-content/pull/9184/solutions/security/alertzero/manage-escalations#manage-escalations-close) when the response is complete.