Work in AlertZero

Workers do the analysis, and you decide what they bring you, such as which alerts to close, how to contain an attack, and which detection rules to change. When the investigation behind a decision needs more work, you can hand it to a teammate or escalate it.

Each kind of work waits in its own section of the Proposed actions page:

Investigate: Alert closures, attacks to send for forensics, and memory dumps.
Respond: Response actions, analyst recommendations, and the proposed action that closes an attack's investigation.
Configure: Detection rule changes.

Each proposed action expires 72 hours after a Worker proposes it. If nobody decides before then, the action doesn't run, and the proposed action shows Expired.

Find the work that fits your role

Your goal	Start here
Clear false positives out of your open alerts	Close false-positive alerts
Take an attack from verdict to containment	Respond to an attack
Act on what a threat hunt found	Act on a hunt finding
Review proposed rule changes and new rules	Tune noisy rules and fill detection gaps
Ask follow-up questions about the evidence	Select Open in chat on the card
Focus on one host, user, or service	Select it in Impacted entities
Hand off the investigation or coordinate a response	Assign it from its card, or escalate it and then manage the escalation
Close the investigation and dismiss all its pending proposed actions	Select Close investigation on its card
Audit recent decisions, including ones Workers made on their own	Expand Closed Actions, which lists decisions from the last 72 hours. A decision that a Worker made on its own names the Worker that made it.