---
title: AlertZero
description: AlertZero Workers triage alerts, hunt for threats, tune detection rules, and investigate attacks in Elastic Security, then bring proposed actions to a person to approve.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9258/solutions/security/alertzero
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# AlertZero
AlertZero is the agentic layer of Elastic Security. Its Workers are AI agents that triage alerts, hunt for threats, tune detection rules, and investigate attacks on a schedule, so your team spends less time sorting through noise and more time on the decisions that need a person.
When a step needs a person, such as closing alerts, isolating a host, or changing a detection rule, a Worker brings it to you as a proposed action on the **Proposed actions** page. Each proposed action comes with an investigation that holds the Worker's evidence and conclusion, so you can check its reasoning before you approve or decline instead of redoing the work.

## What Workers take on

Workers are grouped into four Watches, one for each area of security operations. The Watches pass work to each other, so a finding in one area can lead to action in another.

| Watch           | What it does                                                                                                                                                            | Workers                        |
|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------|
| Triage Watch    | Classifies new alerts, proposes closing false positives, and groups related alerts into attacks, so you review proposed actions instead of individual alerts.           | Alert Triage, Attack Discovery |
| Hunt Watch      | Hunts your data for activity described in threat reports that your detection rules might have missed, so you have fewer blind spots.                                    | Continuous Threat Hunt         |
| Detection Watch | Tunes noisy rules to cut false positives, and proposes turning on an existing rule, installing a prebuilt rule, or creating a new one to cover gaps in your detections. | Rule Tuning, Rule Coverage     |
| Forensics Watch | Investigates attacks and proposes response actions, such as isolating a host.                                                                                           | Endpoint Analysis              |


## How much Workers can act on their own

Every Worker starts at Manual autonomy, so each proposed action waits for your approval. You can raise the level for some Workers. A Worker approves its own proposed actions only at Supervised, and changes to detection rules always wait for you.
To change a Worker's level, or to check what it does at each level, open the Worker's Watch on the **Watches** page.

## What you're billed for

<applies-to>
  - Serverless Security projects: Preview
  - Elastic Cloud Hosted: Preview
</applies-to>

Workers can add to your bill in three ways:
- **Workflow executions:** Workers run as workflows, so each run counts as a workflow execution.
- **Elastic Agent Builder executions:** When a Worker asks an AI agent to analyze its findings, each agent response counts as an Elastic Agent Builder execution.
- **AI model tokens:** If the space uses an Elastic Managed LLM, Elastic bills its model calls by token. Third-party model providers bill you directly.


## Get started

AlertZero is off by default, and you turn it on separately in each space. To start, turn on the **AlertZero** setting in **Advanced Settings**, then select **AlertZero** in the navigation menu and follow the onboarding steps.