You must create a query and save it before it can be scheduled. For more information about creating a query, see Create a query by name: Request.
Use the NDR Console scheduled search feature to query network traffic regularly. When the scheduled search returns a specified number of results, a report is generated.
The NDR Console appliance retains up to 10 sets of search results. Older search results are automatically deleted. You can manually delete results. You can also create a report to save the results.
In addition to running predefined queries, the NDR Console appliance can also run queries with changing parameters. For example, you can create a query that uses a list of IP addresses from a threat feed; see Create a scheduled search: Request . You can update the IP addresses using the API; see Update a scheduled search by name: Request.
The following scheduled search endpoints are available:
Create a scheduled search: Request
POST https://<IA_IP_address>:port_number>/scheduledsearch/v1/watch/<user_name>Scheduled search by name: Request
GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>/<scheduled_search_name>Update a scheduled search by name: Request
P
UT https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>/scheduled_search_name>Delete a scheduled search by name: Request
DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>/<scheduled_search_name>Scheduled searches by user: Request
GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>Delete scheduled searches by user: Request
DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watch/<user_name>All scheduled searches: Request
GET https://<IA_IP_address&>:<port_number>/scheduledsearch/v1/watchDelete all scheduled searches: Request
DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchSearch result reports by user: Request
GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchreport/<user_name>Delete search results reports by user: Request
DELETE https://<IA_IP_address>:&<port_number>/scheduledsearch/v1/watchreport/<user_name>Search result report by scheduled search: Request
GET https://<IA_IP_address>:&<port_number>/scheduledsearch/v1/watchreport/<user_name>/<scheduled_search_name>Delete search result reports by scheduled search: Request
DELETE https://<IA_IP_address>:&<port_number>/scheduledsearch/v1/watchreport/<user_name>/<scheduled_search_name>Search result report by ID: Request
GET https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchreport/<user_name>/<scheduled_search_name>/<report_ID>Delete a search result report by ID: Request
DELETE https://<IA_IP_address>:<port_number>/scheduledsearch/v1/watchreport/<user_name>/<scheduled_search_name>/<report_ID>