The following article provides information on how to duplicate, delete, or cancel an existing Threat Hunt job.
Duplicate a Threat Hunt job
Use the duplicate Threat Hunt feature to run the Threat Hunt job with identical scan criteria across different time ranges or multiple resources.
To duplicate the Threat Hunt job, perform the following steps:
Click the Global Navigation Panel and select Cyber Resilience > Threat Hunting. The Threat Hunting Dashboard page will then be displayed.
On the Threat Hunt dashboard page, choose the Threat Hunt job that you want to replicate and click on more options (three vertical blue dots) > Duplicate.
On the Threat Details tab, update the details as needed and click Next.
On the Resources tab, select the resources to scan. Click to search for resources. Specify the following details and click Search. Resources from the original Threat Hunt job will be selected by default.
Select Organization
Select VCentre/ESxi Host
Enter Virtual Machine details
From the list of resources displayed, select the resources (Virtual Machines) that you want to scan.
In the Snapshots to scan section, specify a date range for scanning snapshots. The range should not exceed 60 days.
Click Next.
On the Actions tab, enable the Auto Quarantine option to automatically quarantine all snapshots containing malicious files within the specified date range.
Click Finish.
Cancel a Threat Hunt job
Use this option if you want to cancel an ongoing Threat Hunt job.
To cancel the Threat Hunt job, perform the following steps:
Click the Global Navigation Panel and select Cyber Resilience > Threat Hunting. The Threat Hunting Dashboard page will then be displayed.
On the Threat Hunt dashboard page, select the Threat Hunt job that you want to abort and click on More Options (three vertical blue dots) > Cancel.
Delete a Threat Hunt job
Use this option if you want to delete an existing Threat Hunt job.
To delete the Threat Hunt job, perform the following steps:
Click the Global Navigation Panel and select Cyber Resilience > Threat Hunting. The Threat Hunting Dashboard page will then be displayed.
On the Threat Hunt dashboard page, choose the Threat Hunt job you want to remove and click on More Options (three vertical blue dots) > Delete. In the confirmation box, provide a reason for deletion and click Continue.