Hunting "Run all Queries"

Question

Hi there!&nbsp;Is there a way that we can automate or schedule "Run all queries" button under Hunting to run every day. Let's say every day morning 8AM it run all queries automatically and send out the report.&nbsp;Thanks!

msraj · Answer

I don't think Sentinel has that option rather than creating Analytics Rules for each query, in fact, the result from hunting queries are temporary for the session.

msraj · Answer

VikramJha&nbsp;If you want to run as a scheduled task, Use the same script from hunting queries and create Analytics Rules. If I am not wrong hunting queries result will not be saved, for future use.&nbsp;&nbsp;

vikramjha · Answer

msraj, Thanks for responding. With scheduled task and analytics rules you can run one query at a time. I'm looking for running all the queries mentioned under Hunting section at once. This is more of a manual job to click that button "Run all queries" to see the results.

Forum Discussion

Hunting "Run all Queries"

Share

Resources