Schedule LogRhythm Echo Use Cases

Use cases can be run on demand or scheduled to run continuously or a specific number of times with a specified delay between each run. Schedules can be created, modified, and deleted, and then run as many times as needed.

In addition, schedules can group one or more use cases together—if a user would like to run the five UEBA use cases out of the approximately 100 use cases in Echo, they could create and run a schedule that includes the five use cases rather than running each UEBA use case individually.

To schedule a use case or view the current schedules, click Schedules.

Echo checks for schedules to run every five seconds and then runs them in sequence, waiting for one to complete before starting the other. If there are many schedules to be run and each schedule takes several seconds to complete, then the frequency of the schedule could be affected. For example, if there are three schedules configured to run every 10 seconds, and each takes five seconds to run, then the actual frequency is 15 seconds.

Create or Modify Schedules

1. To modify a schedule, click the Edit Schedule icon for the schedule. Skip to step 3.

2. To create a schedule, click New Schedule.
   Enter a title and description for your schedule, select one of the Schedule fields, and then select one or more use cases to add to the schedule.

   

   When you click Save, the schedule begins running immediately. The schedule can be stopped by clicking the Pause Schedule icon for the schedule.
3. To delete a schedule, click the Delete Schedule icon for the schedule.

Start or Stop Schedules

1. To start a schedule, click the Resume Schedule icon for the schedule.
2. If the schedule is Continuous, then the use cases replay at the beginning of the specified interval until you click the Pause Schedule icon.
3. If the schedule is not Continuous, then the use cases replay at the beginning of the specified interval until the specified number of runs has been reached, or until you click the Pause Schedule icon.

View Results for Schedules

To view the results of a schedule, click the View Results icon for the schedule.

Results for each schedule will be deleted after one week or when the number of results for a schedule is more than two (FIFO).