[nastasha-solomon]

Summary

Fixes elastic/docs-content-internal#1816.
Fixes elastic/docs-content-internal#1918.

Adds the AlertZero pages for reviewing and deciding the work that Workers propose. Work in AlertZero is the starting point, with one decision page for each kind of proposal:

• Closing false-positive alerts
• Responding to an attack
• Acting on a threat hunt finding
• Changing detection rules

The placeholder pages were renamed to match their tasks, with redirects from the old paths:

• use-alertzero.md is now work-in-alertzero.md.
• decide-proposed-action.md is now close-false-positive-alerts.md.

The "Review closed proposed actions" page was removed and redirected to the "Close false-positive alerts" page. The Attack Discovery and Tune detection rules pages also now link to the new pages.

Navigation

The new and renamed pages sit under Work in AlertZero, before the escalation pages, which this PR doesn't change.

Work in AlertZero                               find the work that fits your role, and where each kind waits on the Proposed actions page
├── Close false-positive alerts                 review a batch of proposed closures, approve or decline it, and check and reopen past closures
├── Respond to an attack                        send an attack for forensics, read the report, decide response actions, and close the investigation
├── Act on a hunt finding                       check what a hunt found, decide its response actions, and follow up on analyst recommendations
├── Tune noisy rules and fill detection gaps    review tuning changes for noisy rules, and decide how to fill detection gaps
├── Escalate an investigation                   (not changed) turn an investigation into a coordinated response
└── Track escalations                           (not changed) #9184 replaces it with Manage escalations, nested under Escalate an investigation

Previews

• Work in AlertZero: Shows where to start for each task, from closing false positives to escalating an investigation, and which section of the Proposed actions page holds each kind of work.
  • Close false-positive alerts: Explains how to review a batch of alerts that AlertZero proposes to close, approve or decline it, and check and reopen past closures.
  • Respond to an attack: Explains how to send an attack for forensics, read the report, decide each response action, and close the investigation.
  • Act on a hunt finding: Explains how to check what a threat hunt found, decide the response actions it proposes, and follow up on anything those actions don't cover.
  • Tune noisy rules and fill detection gaps: Explains how to review proposed changes to noisy rules and decide how to fill detection gaps.
• Glossary: Points the proposed action entry and the Next steps list at Work in AlertZero.
• Attack Discovery and Tune detection rules: Adds links to Respond to an attack and Tune noisy rules and fill detection gaps. On Tune detection rules, the link is a tip that says the feature needs AlertZero.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Tool(s) and model(s) used: Claude Opus 5.5, via Claude Code and Cursor

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 2 warnings, 2 suggestions found

⚠️ Warnings (2): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
solutions/security/alertzero/close-false-positive-alerts.md	21	Elastic.Spelling	'triages' is a possible misspelling.
solutions/security/alertzero/close-false-positive-alerts.md	25	Elastic.Spelling	'triages' is a possible misspelling.

💡 Suggestions (2): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
solutions/security/alertzero/act-on-hunt-finding.md	38	Elastic.WordChoice	Consider using 'cancel, stop' instead of 'Kill', unless the term is in the UI.
solutions/security/alertzero/respond-to-attack.md	44	Elastic.WordChoice	Consider using 'cancel, stop' instead of 'Kill', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/ai/attack-discovery/index.md
• solutions/security/alertzero/act-on-hunt-finding.md
• solutions/security/alertzero/close-false-positive-alerts.md
• solutions/security/alertzero/decide-detection-change.md
• solutions/security/alertzero/decide-proposed-action.md
• solutions/security/alertzero/glossary.md
• solutions/security/alertzero/index.md
• solutions/security/alertzero/respond-to-attack.md
• solutions/security/alertzero/review-closed-proposed-actions.md
• solutions/security/alertzero/use-alertzero.md

More links …

• solutions/security/alertzero/work-in-alertzero.md
• solutions/security/detect-and-alert/tune-detection-rules.md

[natasha-moore-elastic]

Thanks for adding these docs! It's a pretty large PR, so I'm reviewing in batches. This batch of comments is for the Close false-positive alerts page.

[natasha-moore-elastic]

Some more suggestions on the rest of the pages, very clear instructions overall! 🚀

[andrew-goldstein]

Thanks @nastasha-solomon for the proposals proposing to document responding to proposals! 🙏
LGTM 🚀