AlertZero

AlertZero is the agentic layer of Elastic Security. Its Workers are AI agents that triage alerts, hunt for threats, tune detection rules, and investigate attacks on a schedule, so your team spends less time sorting through noise and more time on the decisions that need a person.

When a step needs a person, such as closing alerts, isolating a host, or changing a detection rule, a Worker brings it to you as a proposed action on the Proposed actions page. Each proposed action comes with an investigation that holds the Worker's evidence and conclusion, so you can check its reasoning before you approve or decline instead of redoing the work.

What Workers take on

Workers are grouped into four Watches, one for each area of security operations. The Watches pass work to each other, so a finding in one area can lead to action in another.

Watch	What it does	Workers
Triage Watch	Classifies new alerts, proposes closing false positives, and groups related alerts into attacks, so you review proposed actions instead of individual alerts.	Alert Triage, Attack Discovery
Hunt Watch	Hunts your data for activity described in threat reports that your detection rules might have missed, so you have fewer blind spots.	Continuous Threat Hunt
Detection Watch	Tunes noisy rules to cut false positives, and proposes turning on an existing rule, installing a prebuilt rule, or creating a new one to cover gaps in your detections.	Rule Tuning, Rule Coverage
Forensics Watch	Investigates attacks and proposes response actions, such as isolating a host.	Endpoint Analysis

To learn how Watches pass work to each other, refer to Watches and Workers.

How much Workers can act on their own

Every Worker starts at Manual autonomy, so each proposed action waits for your approval. You can raise the level for some Workers. A Worker approves its own proposed actions only at Supervised, and changes to detection rules always wait for you.

To change a Worker's level, or to check what it does at each level, refer to Configure Worker settings.

What you're billed for

Workers can add to your bill in three ways:

Workflow executions: Workers run as workflows, so each run counts as a workflow execution.
Elastic Agent Builder executions: When a Worker asks an AI agent to analyze its findings, each agent response counts as an Elastic Agent Builder execution.
AI model tokens: If the space uses an Elastic Managed LLM, Elastic bills its model calls by token. Third-party model providers bill you directly.

For rates and free monthly allowances, refer to Elastic Security Serverless billing dimensions for Serverless and Elastic Cloud Hosted billing dimensions for Elastic Cloud Hosted.

Get started

AlertZero is off by default, and you turn it on separately in each space.

Set up AlertZero: Turn on AlertZero and start its Workers.
Grant access to AlertZero: Give your team access to view and decide proposed actions.
Work in AlertZero: Find the proposed actions that need your decision.