Scheduling a Snapshot

You can schedule a snapshot to be taken at intervals. The schedule frequency can be part of your daily analysis and operations. For example, as a best practice, you can run Threat Detector once a day to capture event patterns that happened over the last 24 hours. You can specify a longer period to find patterns with a longer term. To fully automate daily Threat Detector, add actions to a schedule, such as sending notifications, opening cases, or adding systems to an active list, if certain conditions are met.

Where: Navigator > Resources > Threat Detector >Profiles tab

Procedure:

1. Right-click a profile and select Schedule Snapshots.

2. On the Jobs tab, click Add.

3. In the Summary field at the bottom, select Click here to set up schedule frequency. This activates the Job Frequency dialog.

   

4. Click OK when you have set the frequency and time range.

5. Repeat as required to add more schedules for the same snapshot.

6. When you have added all the schedules for this snapshot, click OK at the bottom of the Jobs tab.

7. To add an action to be taken every time the profile is run, specify an action in the Actions tab of the profile editor, as described in Specifying Actions.