---
title: Manage escalations
description: Find AlertZero escalations, read their summaries, work on them with your team, change who is assigned and who can see them, and close them.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9184/solutions/security/alertzero/manage-escalations
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# Manage escalations
Use the **Escalations** page to see which escalations are open, who is assigned to each, and where each one stands. You see every escalation that you have access to in one place, and each one shows its assignees.
<admonition title="Requirements">
  To see, assign, or close an escalation, your role needs specific privileges. Refer to [AlertZero privileges](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9184/solutions/security/alertzero/alertzero-privileges).
</admonition>


## Find your escalations

1. Open the **Escalations** page from the navigation menu, or search for it with the global search field.
2. Check each open escalation. It shows the title, when it was opened and last updated, and who it's assigned to.
3. Optional: To see only the escalations that involve a specific host, user, or other entity, select it under **Impacted entities**. The filter applies to both the open and closed lists.

You see escalations that are public, and private ones that you own or were given access to.

## Read an escalation's summary

Select an escalation to open it as a chat in Elastic Agent Builder, with its details flyout. The flyout shows:
- A summary that AlertZero writes from the messages, notes, and attachments in the escalation. It refreshes shortly after new messages, notes, or attachments are added to the escalation. Closing a linked investigation doesn't refresh it.
- The attachments collected from the linked investigations.
- Linked investigations, each with an **Open** or **Closed** badge. An open investigation with proposed actions that nobody has decided yet shows **Action required**.
- The entities that the linked investigations affect.

The flyout header shows the escalation title, status, and assignees, and when it was created.

## Work on an escalation

The escalation is where you and your team coordinate the response. Everyone who can see it can read the full conversation and send messages in it. You decide on proposed actions in the linked investigations.
1. In the details flyout, under **Linked investigations**, select each investigation marked **Action required**, and decide on its proposed actions. To learn how, refer to [Use AlertZero](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9184/solutions/security/alertzero/use-alertzero).
2. To talk to your team, send a message in the chat. To post a message for the other people without asking the agent to respond, select **Include agent**, and then select **Skip agent**. To learn more, refer to [Chat with Elastic Agent Builder agents > Post without running the agent](/elastic/docs-content/pull/9184/explore-analyze/ai-features/agent-builder/chat#post-without-running-the-agent).


## Change who is assigned

1. On the **Escalations** page, select **Add or change assignees** `plus_circle` next to the escalation.
2. Search for users, then select or clear them.

On a private escalation, adding an assignee also gives that person access to it, and removing an assignee removes their access.

## Change who can see an escalation

Only the owner of an escalation can change who can see it. Open the escalation and use the sharing button in the chat header, as described in [Chat with Elastic Agent Builder agents > Share a conversation](/elastic/docs-content/pull/9184/explore-analyze/ai-features/agent-builder/chat#share-a-conversation).
Changing who can see an escalation doesn't change who is assigned to it.

## Close an escalation

Close an escalation when the response is complete.
1. Open the escalation, and then select its status in the flyout header.
2. Select **Closed**.
3. In the **Close this escalation?** window, review the linked investigations that will be closed and the number of pending proposed actions that will be declined.
4. If there are pending proposed actions, select a reason for declining them. You can also add an optional note. Your reason and notes apply to all the declined proposed actions.
5. Select **Close escalation**.

<warning>
  Closing an escalation also closes its open linked investigations and their chats, and declines their pending proposed actions.
</warning>

If a linked investigation has been deleted or isn't accessible to you, you can't close the escalation until you resolve the problem. If a linked investigation can't be closed, for example because a pending proposed action can't be declined, the escalation stays open. Check that you have the required privileges, and then try again.