AlertZero

AlertZero is the agentic layer of Elastic Security. Its Workers are AI agents that triage alerts, hunt for threats, tune detection rules, and investigate attacks on a schedule, so your team spends less time sorting through noise and more time on the decisions that need a person.

When a step needs a person, such as closing alerts, isolating a host, or changing a detection rule, a Worker brings it to you as a proposed action on the Proposed actions page. Each proposed action comes with an investigation that holds the Worker's evidence and conclusion, so you can check its reasoning before you approve or decline instead of redoing the work.

Workers are grouped into four Watches, one for each area of security operations. The Watches pass work to each other, so a finding in one area can lead to action in another.

Watch What it does Workers
Triage Watch Classifies new alerts, proposes closing false positives, and groups related alerts into attacks, so you review proposed actions instead of individual alerts. Alert Triage, Attack Discovery
Hunt Watch Hunts your data for activity described in threat reports that your detection rules might have missed, so you have fewer blind spots. Continuous Threat Hunt
Detection Watch Tunes noisy rules to cut false positives, and proposes turning on an existing rule, installing a prebuilt rule, or creating a new one to cover gaps in your detections. Rule Tuning, Rule Coverage
Forensics Watch Investigates attacks and proposes response actions, such as isolating a host. Endpoint Analysis

To learn how Watches pass work to each other, refer to Watches and Workers.

Every Worker starts at Manual autonomy, so each proposed action waits for your approval. You can raise the level for some Workers. A Worker approves its own proposed actions only at Supervised, and changes to detection rules always wait for you.

To change a Worker's level, or to check what it does at each level, refer to Configure Worker settings.

Workers can add to your bill in three ways:

  • Workflow executions: Workers run as workflows, so each run counts as a workflow execution.
  • Elastic Agent Builder executions: When a Worker asks an AI agent to analyze its findings, each agent response counts as an Elastic Agent Builder execution.
  • AI model tokens: If the space uses an Elastic Managed LLM, Elastic bills its model calls by token. Third-party model providers bill you directly.

For rates and free monthly allowances, refer to Elastic Security Serverless billing dimensions for Serverless and Elastic Cloud Hosted billing dimensions for Elastic Cloud Hosted.

AlertZero is off by default, and you turn it on separately in each space.