The following article provides information on how to duplicate, delete, or cancel an existing Threat Hunt job.

Duplicate a Threat Hunt job

Use the duplicate Threat Hunt feature to run the Threat Hunt job with identical scan criteria across different time ranges or multiple resources.

To duplicate the Threat Hunt job, perform the following steps:

Click the Global Navigation Panel and select Cyber Resilience > Threat Hunting. The Threat Hunting Dashboard page will then be displayed.
On the Threat Hunt dashboard page, choose the Threat Hunt job that you want to replicate and click on more options (three vertical blue dots) > Duplicate.
On the Threat Details tab, update the details as needed and click Next.
On the Resources tab, resources from the original Threat Hunt job will be selected by default.
From the list of resources displayed, select the resources (Virtual Machines or EC2 and EBS Volume) that you want to scan.
In the Snapshots to scan section, specify a date range for scanning snapshots. The range should not exceed 60 days.
Click Next.
On the Actions tab, enable the Auto Quarantine option to automatically quarantine all snapshots containing malicious files within the specified date range.

❗Important: Auto-quarantine and Quarantine features are not supported for AWS Workloads (EC2 and EBS Volume).
Click Finish.

Cancel a Threat Hunt job

Use this option if you want to cancel an ongoing Threat Hunt job.

To cancel the Threat Hunt job, perform the following steps:

Click the Global Navigation Panel and select Cyber Resilience > Threat Hunting. The Threat Hunting Dashboard page will then be displayed.
On the Threat Hunt dashboard page, select the Threat Hunt job that you want to abort and click on More Options (three vertical blue dots) > Cancel.

Use this option if you want to delete an existing Threat Hunt job.

To delete the Threat Hunt job, perform the following steps:

Click the Global Navigation Panel and select Cyber Resilience > Threat Hunting. The Threat Hunting Dashboard page will then be displayed.
On the Threat Hunt dashboard page, choose the Threat Hunt job you want to remove and click on More Options (three vertical blue dots) > Delete. In the confirmation box, provide a reason for deletion and click Continue.