Manage escalations

Use the Escalations page to see which escalations are open, who is assigned to each, and where each one stands. You see every escalation that you have access to in one place, and each one shows its assignees.

1. Open the Escalations page from the navigation menu, or search for it with the global search field.
2. Check each open escalation. It shows the title, when it was opened and last updated, and who it's assigned to.
3. Optional: To see only the escalations that involve a specific host, user, or other entity, select it under Impacted entities. The filter applies to both the open and closed lists.

You see escalations that are public, and private ones that you own or were given access to.

Select an escalation to open it as a chat in Elastic Agent Builder, with its details flyout. The flyout shows:

• A summary that AlertZero writes from the messages, notes, and attachments in the escalation. It refreshes shortly after new messages, notes, or attachments are added to the escalation. Closing a linked investigation doesn't refresh it.
• The attachments collected from the linked investigations.
• Linked investigations, each with an Open or Closed badge. An open investigation with proposed actions that nobody has decided yet shows Action required.
• The entities that the linked investigations affect.

The flyout header shows the escalation title, status, and assignees, and when it was created.

The escalation is where you and your team coordinate the response. Everyone who can see it can read the full conversation and send messages in it. You decide on proposed actions in the linked investigations.

1. In the details flyout, under Linked investigations, select each investigation marked Action required, and decide on its proposed actions. To learn how, refer to Work in AlertZero.
2. To talk to your team, send a message in the chat. To post a message for the other people without asking the agent to respond, select Include agent, and then select Skip agent. To learn more, refer to Chat with Elastic Agent Builder agents > Post without running the agent.

1. On the Escalations page, select Add or change assignees next to the escalation.
2. Search for users, then select or clear them.

On a private escalation, adding an assignee also gives that person access to it, and removing an assignee removes their access.

Only the owner of an escalation can change who can see it. Open the escalation and use the sharing button in the chat header, as described in Chat with Elastic Agent Builder agents > Share a conversation.

Changing who can see an escalation doesn't change who is assigned to it.

Close an escalation when the response is complete.

1. Open the escalation, and then select its status in the flyout header.
2. Select Closed.
3. In the Close this escalation? window, review the linked investigations that will be closed and the number of pending proposed actions that will be declined.
4. If there are pending proposed actions, select a reason for declining them. You can also add an optional note. Your reason and notes apply to all the declined proposed actions.
5. Select Close escalation.

If a linked investigation has been deleted or isn't accessible to you, you can't close the escalation until you resolve the problem. If a linked investigation can't be closed, for example because a pending proposed action can't be declined, the escalation stays open. Check that you have the required privileges, and then try again.