---
title: AlertZero
description: AlertZero Workers triage alerts, hunt for threats, tune detection rules, and investigate attacks in Elastic Security, then bring proposed actions to a person to approve.
url: https://www.elastic.co/docs/solutions/security/alertzero
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# AlertZero
AlertZero is the agentic layer of Elastic Security. Its Workers are AI agents that triage alerts, hunt for threats, tune detection rules, and investigate attacks on a schedule, so your team spends less time sorting through noise and more time on the decisions that need a person.
When a step needs a person, such as closing alerts, isolating a host, or changing a detection rule, a Worker brings it to you as a proposed action on the [**Proposed actions** page](https://www.elastic.co/docs/solutions/security/alertzero/work-in-alertzero). Each proposed action comes with an investigation that holds the Worker's evidence and conclusion, so you can check its reasoning before you approve or decline instead of redoing the work.

## What Workers take on

Workers are grouped into four Watches, one for each area of security operations. The Watches pass work to each other, so a finding in one area can lead to action in another.

| Watch                                                                                               | What it does                                                                                                                                                            | Workers                        |
|-----------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------|
| [Triage Watch](/docs/solutions/security/alertzero/watches-and-workers#alertzero-triage-watch)       | Classifies new alerts, proposes closing false positives, and groups related alerts into attacks, so you review proposed actions instead of individual alerts.           | Alert Triage, Attack Discovery |
| [Hunt Watch](/docs/solutions/security/alertzero/watches-and-workers#alertzero-hunt-watch)           | Hunts your data for activity described in threat reports that your detection rules might have missed, so you have fewer blind spots.                                    | Continuous Threat Hunt         |
| [Detection Watch](/docs/solutions/security/alertzero/watches-and-workers#alertzero-detection-watch) | Tunes noisy rules to cut false positives, and proposes turning on an existing rule, installing a prebuilt rule, or creating a new one to cover gaps in your detections. | Rule Tuning, Rule Coverage     |
| [Forensics Watch](/docs/solutions/security/alertzero/watches-and-workers#alertzero-forensics-watch) | Investigates attacks and proposes response actions, such as isolating a host.                                                                                           | Endpoint Analysis              |

To learn how Watches pass work to each other, refer to [Watches and Workers](https://www.elastic.co/docs/solutions/security/alertzero/watches-and-workers).

## How much Workers can act on their own

Every Worker starts at Manual autonomy, so each proposed action waits for your approval. You can raise the level for some Workers. A Worker approves its own proposed actions only at Supervised, and changes to detection rules always wait for you.
To change a Worker's level, or to check what it does at each level, refer to [Configure Worker settings](https://www.elastic.co/docs/solutions/security/alertzero/configure-worker-settings).

## What you're billed for

<applies-to>
  - Serverless Security projects: Preview
  - Elastic Cloud Hosted: Preview
</applies-to>

Workers can add to your bill in three ways:
- **Workflow executions:** Workers run as workflows, so each run counts as a [workflow execution](/docs/explore-analyze/workflows/authoring-techniques/monitor-workflows#workflows-execution-billing).
- **Elastic Agent Builder executions:** When a Worker asks an AI agent to analyze its findings, each agent response counts as an [Elastic Agent Builder execution](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/monitor-usage).
- **AI model tokens:** If the space uses an [Elastic Managed LLM](https://docs-demo.elastic.dev/docs/reference/kibana/connectors-kibana/elastic-managed-llm), Elastic bills its model calls by token. Third-party model providers bill you directly.

For rates and free monthly allowances, refer to [Elastic Security Serverless billing dimensions](https://www.elastic.co/docs/deploy-manage/cloud-organization/billing/security-billing-dimensions) for Serverless and [Elastic Cloud Hosted billing dimensions](https://www.elastic.co/docs/deploy-manage/cloud-organization/billing/cloud-hosted-deployment-billing-dimensions) for Elastic Cloud Hosted.

## Get started

AlertZero is off by default, and you turn it on separately in each [space](https://www.elastic.co/docs/deploy-manage/manage-spaces).
- [Set up AlertZero](https://www.elastic.co/docs/solutions/security/alertzero/set-up-alertzero): Turn on AlertZero and start its Workers.
- [Grant access to AlertZero](https://www.elastic.co/docs/solutions/security/alertzero/alertzero-privileges): Give your team access to view and decide proposed actions.
- [Work in AlertZero](https://www.elastic.co/docs/solutions/security/alertzero/work-in-alertzero): Find the proposed actions that need your decision.