[AlertZero] Document the Triage Watch and Detection Watch Workers by nastasha-solomon · Pull Request #9118 · elastic/docs-content

nastasha-solomon · 2026-10-31T21:35:03Z

Summary

Fixes elastic/docs-content-internal#1814.

Documents the Triage Watch and Detection Watch, with a page for each Watch and each of their Workers. The Hunt Watch, Forensics Watch, Continuous Threat Hunt Worker, and Endpoint Analysis Worker pages are placeholders for future content. Configure Watches and Workers replaces the Watches and Workers page.

AlertZero → Manage AlertZero
├── Configure Watches and Workers           compare Workers, set approvals, change settings
│   ├── Triage Watch                        reviews incoming alerts
│   │   ├── Alert Triage Worker             triages alerts and proposes closures
│   │   └── Attack Discovery Worker         finds attacks and hands them to forensics
│   ├── Detection Watch                     improves detection rules at the source
│   │   ├── Rule Tuning Worker              tunes noisy rules
│   │   └── Rule Coverage Worker            fills detection gaps
│   ├── Hunt Watch                          placeholder
│   │   └── Continuous Threat Hunt Worker   placeholder
│   └── Forensics Watch                     placeholder
│       └── Endpoint Analysis Worker        placeholder
└── Run a Worker manually                   renamed from Run a Worker on demand

AlertZero
└── Glossary                                rewords the Watch, Worker, and autonomy definitions

Previews

Configure Watches and Workers - Added a comparison of all Workers, how they depend on each other, what you approve, and how to change Worker settings.
Triage Watch - Added what the Triage Watch does and when to turn it on.
Alert Triage Worker - Added what the Worker does, the data it needs, how it works, and its settings.
Attack Discovery Worker - Added what the Worker does, how it hands attacks to forensics, its settings, and its limits.
Detection Watch - Added what the Detection Watch does and when to turn it on.
Rule Tuning Worker - Added what the Worker does, the false positive thresholds that decide which rules it tunes, and its limits.
Rule Coverage Worker - Added what the Worker does, the settings that control how many detection gaps it works on, and its limits.
Hunt Watch - Added a placeholder page.
Continuous Threat Hunt Worker - Added a placeholder page.
Forensics Watch - Added a placeholder page.
Endpoint Analysis Worker - Added a placeholder page.
Run a Worker manually - Renamed the page from Run a Worker on demand.
Glossary - Reworded the Watch, Worker, and autonomy definitions to match the new pages.
Watches and Workers - Removed the page and redirected it to Configure Watches and Workers.

Generative AI disclosure

Did you use a generative AI (GenAI) tool to assist in creating this contribution?

Yes
No

Tool(s) and model(s) used: Claude Opus 5.5, via Claude Code and Cursor

Fill in the Triage Watch (Alert Triage, Attack Discovery) and Detection Watch (Rule Tuning, Rule Coverage) sections of Watches and Workers, and the page intro. The Hunt Watch and Forensics Watch sections are left for their owner. Verified against elastic/kibana branch 9.6. Part of elastic/docs-content-internal#1814. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…handoffs AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-31T21:35:54Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

github-actions · 2026-10-31T21:37:25Z

🔍 Preview links for changed docs

Elastic Docs Style Checker (Vale)

Summary: 3 warnings found

⚠️ Warnings (3): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
solutions/security/alertzero/watches/alert-triage-worker.md	2	Elastic.Spelling	'triages' is a possible misspelling.
solutions/security/alertzero/watches/alert-triage-worker.md	14	Elastic.Spelling	'triages' is a possible misspelling.
solutions/security/alertzero/watches/rule-tuning-worker.md	28	Elastic.Spelling	'backtest' is a possible misspelling.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

Use the Watch variables in the section headings, rewrite the common settings sentence and several entries in plain language, state each schedule default in one phrase, follow Attack Discovery with Worker on a page that also covers the feature, and cut a repeated dependency sentence. Italicize the placeholder inside the bold investigation names. List serverless first in applies_to. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Add the off-by-default settings that Alert Triage, Attack Discovery, and Rule Coverage need, fix the Alert analysis workflow link, say that only scheduled Workers have a Trigger, and say that Attack Discovery closes false positives at either autonomy level. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Turns the single reference page into a hub, a page per Watch, and a page per Worker, modeled on Common rule settings, so each Watch and Worker has room to grow. - The hub keeps the shared settings and adds a table comparing Workers. - Triage Watch and Detection Watch Worker pages carry the existing content, with settings as definition lists and their defaults, ranges, and default autonomy (Manual) checked against elastic/kibana 9.6. - Hunt Watch and Forensics Watch pages and their Worker pages are stubs. - The glossary links to the new Watch pages instead of hub anchors. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…page #9118 splits Watches and Workers into a page per Watch, which removes the Watch anchors this table linked to. Link each Watch to the page itself so the build passes whichever PR merges first, and keep the links to the new Watch pages in a comment to uncomment after #9118 merges. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Unhide the AlertZero landing page and the Watches and Workers pages in the TOC so the PR preview shows their structure in the nav. The landing page must be visible for its children to appear. A comment in the TOC says to change these entries back to hidden when the AlertZero PRs merge, if AlertZero should stay hidden. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Move the Context Engine explanation here from the AlertZero landing page in #9114, which is now an entry point without implementation detail. Link each Worker to its page, and point to Requirements for the setting and to Manage AlertZero for the index it uses. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Landing page: keep it to what AlertZero is, how it works with one example, what each Watch covers, how much Workers do without you, costs, and an ordered Get started path. Move the Context Engine section to the Watches and Workers page in #9118, and the indexes note to Manage AlertZero. Shorten the Watch table and the autonomy and cost sections. Set up: point Before you begin at the two Requirements sections, move the advanced setting key here, split the Workers step from its notes, and list Review your first proposed action and Manage AlertZero as next steps. Manage AlertZero: replace the placeholder intro with links to its pages. Use variables in the Manage and Configure headings, and list serverless first in their applies_to. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ne place Watches and Workers: add a table of what each Worker does at each autonomy level, the one place for that, and drop the levels column from the comparison table. Worker pages: lead with what the Worker does, keep only Worker-specific settings and limits, drop the Requirements sections (Requirements covers them), move daily-use facts to the decision pages, and end with links to set up, decide, and configure. Watch pages: say how their Workers build on each other and where you decide their work. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Decide a detection change: shorten the intro, say that approving a change doesn't give you the privileges to make it, move the new-rule checks into the steps, and link to the Watches and Workers page so the link survives #9118. Respond to an attack: replace the setup prerequisites with what to do when the handoff fails, say that an approved response action runs as you and can come back for someone else, mark the forensics handoff as the triage step, and shorten the autonomy section to the facts this flow needs. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…kers Rewrite "a {{az-worker}}" so the text still reads correctly if the Worker name changes to one that takes "an". AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Move the Watches and Workers content onto the Configure Worker settings page, rename it Configure Watches and Workers, and nest the Watch and Worker pages under it in the TOC. Delete Watches and Workers and redirect it to the configure page. Link the Watch and Worker names to their pages, and point the Worker pages and glossary to the new page. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Fold the Requirements page into Set up AlertZero so readers check what they need and turn AlertZero on in one place. Remove Review your first proposed action, since one walkthrough can't fit every setup. Add redirects for both removed pages. Link to Configure Worker settings by page until #9118 merges, with comments saying which anchors to add then. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Point Decide a detection change and Respond to an attack to Configure Watches and Workers and Set up AlertZero, which replace the Watches and Workers and Requirements pages in #9118 and #9114. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Restore Watches and Workers as the overview, with the Worker comparison table and how Watches pass work to each other, and remove its redirect. Turn the configure page into a how-to: Configure Workers, with steps to change a Worker's settings, what turning a Worker on or off does, and what each autonomy level does. Nest the Watch and Worker pages under the overview in the navigation. Note in comments the privilege and Worker prerequisites that the admin pages should cover. AI-Assisted: Drafted with Cursor (Claude Opus 5.5) Co-authored-by: Cursor <cursoragent@cursor.com>

…ples Worker pages: add When to use, Data requirements, How it works with numbered steps, and an example. List Trigger, Autonomy, and Models in Settings with each Worker's own settings, and say where you review the Worker's work and why to follow the link. Watch pages: lead table cells with the related Worker and add When to turn on guidance. Use active voice and full Worker names, say "rule preview" instead of "backtest", bold autonomy levels, and fix contradictions with the code: Rule Tuning acts only on false positives, and Attack Discovery acknowledges alerts and closes the investigation for a false positive. AI-Assisted: Drafted with Cursor (Claude Opus 5.5) Co-authored-by: Cursor <cursoragent@cursor.com>

Say you approve or decline a proposed action, which matches the Approve and Decline buttons and Decide a proposed action. Match the Worker privileges to AlertZero privileges, add the Approved status and the handoff trigger to the glossary, and say AlertZero doesn't turn Workers on or off after setup. Drop the comments on the privileges and Requirements pages, which other PRs rewrite or delete. AI-Assisted: Drafted with Cursor (Claude Opus 5.5) Co-authored-by: Cursor <cursoragent@cursor.com>

Landing page: rewrite the intro and define Workers, fold How it works into the intro, explain that Watches group Workers, rename headings to answer reader questions, correct billing to match Kibana's metering, and trim Get started to three links. Set up: drop requirements every user already meets, the per-Worker requirements and error messages (onboarding and #9118 cover them), and point to onboarding. Add a section on deciding which Workers to run. Manage: remove the cost section and the index details, rewrite the intro as prose, and spell out the steps to turn AlertZero off. Show the AlertZero pages in the navigation for the preview, and rename Run a Worker on demand to Manually run a Worker. AI-Assisted: Drafted with Cursor (Claude Opus 5.5) Co-authored-by: Cursor <cursoragent@cursor.com>

Close false-positive alerts (decide-proposed-action.md, reworked in #9116) now covers only the Alert Triage Worker's closures, not the steps every decision shares. Reword the Triage Watch and Alert Triage Worker links to match, and point the glossary's proposed action entry to Work in AlertZero. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ktest Checked against Kibana 9.6. The Endpoint Analysis Worker analyzes one host per attack. For a false positive, the Attack Discovery Worker also closes the attack. The before-and-after comparison is labeled Backtest, and Rule Coverage's Backtest counts matches on past data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Checked against Kibana 9.6. All six Workers run as billable workflows, not only the Hunt Watch and Detection Watch ones. The rule that at least one Worker stays selected applies only in onboarding. Onboarding blocks on a missing model but doesn't check for data. Rule Coverage and Endpoint Analysis need Context Engine, and Attack Discovery and Continuous Threat Hunt need it to pass work on. The Attack Discovery Worker can't be run manually. Retitle the run page to match #9118. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… Workers Restore the merge from 36f499a, which 89b89b3 undid. Move the Worker comparison table and how Watches pass work to each other back onto the configure page, rename it Configure Watches and Workers, and nest the Watch and Worker pages under it in the TOC. Delete Watches and Workers, redirect it to the configure page, and point the glossary's Related list to the configure page. Keep the configure page's later changes: the steps to change a Worker's settings, the privileges, the autonomy tables, and what turning off Continuous Threat Hunt does. Leave out Settings every Worker has, which the Worker pages now cover. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

#9118 deletes Watches and Workers and moves its content to configure-worker-settings.md, so links to it fail the build once that PR merges. Point the Watch table, the handoff link, and the Set up AlertZero link to the configure page, which exists on main and in #9118. Note the anchors to add after #9118 merges. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Manage AlertZero doesn't cover the index, so remove the reference to it on the configure page. Point the TODO comments at the anchors that #9114 defines. Drop the TODO on the Alert Triage and Rule Tuning pages, which have no setup requirement of their own. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Add the Watch and Worker pages under Configure Watches and Workers, hidden, remove the deleted Watches and Workers entry, and drop the preview-only changes and their TEMPORARY comments. The other AlertZero PRs then merge without toc conflicts. A final navigation PR will set the order and which pages show. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…cies and approvals Co-authored-by: Cursor <cursoragent@cursor.com>

#9118 folds the Context Engine section into How Workers depend on each other and adds a Change Worker settings section. Point the landing page and Manage AlertZero TODOs at those anchors. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Configure Watches and Workers: say that Workers need Context Engine to pass results, and link to Set up AlertZero for what happens without it, instead of repeating it. In the Change Worker settings note, say that manage_security also manages users and roles for the whole cluster, so readers should ask an administrator who already has it. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Add model-recommendations.md as a hidden child of Set up AlertZero, the page the Worker pages in #9118 already plan to link to. It holds one line of visible text, and % comments record what Kibana 9.6 and decision D49 settle and what engineering is still deciding, so the page stays hidden until the model choice is final. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Uses the labels from elastic/kibana#301720: Schedule (was Trigger), Exclude building block alerts, Ingest threat feeds, and Enrich threat report. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

nastasha-solomon · 2026-11-02T15:02:50Z

Closing this in favor of using #9144.

…atches and Workers - Name the Proposed actions page instead of the AlertZero home page, to match the page heading. - Link each Watch, and how Watches hand work to each other, to Watches and Workers. - Drop the autonomy anchor that #9144 removes from Configure Worker settings. - Remove the notes that waited on #9118, which was replaced. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

nastasha-solomon and others added 2 commits October 31, 2026 17:31

[AlertZero] Add the Context Engine prerequisite for Attack Discovery …

65b0aa7

…handoffs AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

nastasha-solomon self-assigned this Oct 31, 2026

nastasha-solomon assigned Copilot Oct 31, 2026

nastasha-solomon added the alertzero label Oct 31, 2026

nastasha-solomon and others added 3 commits October 31, 2026 17:55

nastasha-solomon and others added 2 commits October 31, 2026 18:11

nastasha-solomon mentioned this pull request Oct 31, 2026

[AlertZero] Add the landing page #9114

Merged

1 of 2 tasks

nastasha-solomon mentioned this pull request Nov 1, 2026

[AlertZero] Order the AlertZero navigation by reader lifecycle #9120

Closed

1 of 2 tasks

nastasha-solomon and others added 2 commits October 31, 2026 20:37

[AlertZero] Use plurals before the Worker variable on Watches and Wor…

e3b4d0d

…kers Rewrite "a {{az-worker}}" so the text still reads correctly if the Worker name changes to one that takes "an". AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

nastasha-solomon and others added 3 commits November 1, 2026 00:20

nastasha-solomon mentioned this pull request Nov 1, 2026

[AlertZero] Add Work in AlertZero and Close false-positive alerts #9116

Closed

1 of 2 tasks

nastasha-solomon and others added 2 commits November 1, 2026 01:44

nastasha-solomon and others added 3 commits November 1, 2026 02:38

[AlertZero] Restructure Configure Watches and Workers around dependen…

318d3e9

…cies and approvals Co-authored-by: Cursor <cursoragent@cursor.com>

nastasha-solomon and others added 2 commits November 1, 2026 04:26

[AlertZero] Tighten the Configure Watches and Workers intro

b0b775c

Co-authored-by: Cursor <cursoragent@cursor.com>

nastasha-solomon and others added 2 commits November 2, 2026 00:19

Match Worker setting labels to the revised Watch settings copy

a05ef49

Uses the labels from elastic/kibana#301720: Schedule (was Trigger), Exclude building block alerts, Ingest threat feeds, and Enrich threat report. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

[AlertZero] Show AlertZero pages in the navigation

512c1f2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

nastasha-solomon closed this Nov 2, 2026

github-actions Bot deployed to docs-preview November 2, 2026 15:06

View deployment

Navigation Menu

Repository navigation

[AlertZero] Document the Triage Watch and Detection Watch Workers - #9118

[AlertZero] Document the Triage Watch and Detection Watch Workers#9118
nastasha-solomon wants to merge 23 commits into
mainfrom
nsolomon/alertzero-watches-workers

nastasha-solomon commented Oct 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 31, 2026

Uh oh!

github-actions Bot commented Oct 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 31, 2026 •

edited

Loading

Uh oh!

nastasha-solomon commented Nov 2, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nastasha-solomon commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Previews

Generative AI disclosure

Uh oh!

github-actions Bot commented Oct 31, 2026

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Elastic Docs Style Checker (Vale)

Uh oh!

nastasha-solomon commented Nov 2, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nastasha-solomon commented Oct 31, 2026 •

edited

Loading

github-actions Bot commented Oct 31, 2026 •

edited

Loading

github-actions Bot commented Oct 31, 2026 •

edited

Loading