I know one way to get a UDM search running on a schedule is to convert it into a YARA-L detection rule, which then runs automatically based on the rule's run frequency. But for use cases where I just want a plain search to run every morning (or every hour , etc) and get the results in an alert for example, is there a native option in the platform to do such a thing?
Question
Is there a native way to schedule a UDM search to run on shedule?
+1- Bronze 1
In the SOAR platform, there is a Scheduled Connector that allows you to create cases at scheduled intervals. You could use the Cron Scheduled Connector, although I haven't tested it myself. As far as I know, it can create a case automatically, so you would just need to build a playbook and add the Chronicle - Search action.
+1- Bronze 1
wonder why there isnt a more direct option, i mean this would be useful for UDM searches that is regularly used
+7- Bronze 2
There is currently no direct native option to schedule a plain UDM search. For alerts, the standard approach is to use a YARA-L rule. For scheduled raw search results, you can use the UDM Search API with an external scheduler, or build a scheduled SOAR playbook.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.