Events Associated with the Wrong Action

If you are running Jobs and the events you expect to see on Action A actually show up on Action B, there are several possible causes:

• The platform isn't waiting long enough before it checks for events after an Action runs (Host CLI Actions).
• For Jobs that contain more than one Action, more time may be needed between running Actions (primarily Host CLI Actions, but could impact other Action types).

To change the Wait time for checking for events for Host CLI Actions

1. Select the Action, Sequence, or Evaluation you want to run & go through the standard configuration process
2. Before clicking run to start the Job, Expand Advanced options on the Job
   

   Job's Advanced options

3. Enter a value, in seconds, in the Extra sleep time field; this time will be applied to all Host CLI Actions that are part of the Job
4. Run the security content. If the Events still aren't associated with the correct Actions, you can increase the sleep time. If there's more than one Action in the Job, you can also increase the wait time between running Actions (see the next section).

To increase the time in between running Actions in a Job

1. Go to Settings > Director Settings.
2. Select Advanced Settings.
3. Find the Time Paused Between Job Actions field and update it to match the time it takes your environment to generate events.
   

   Advanced Settings highlighting Time Paused between Job Actions

4. Click Update Advanced Settings. If the events are still associated with the wrong Action, you may need to increase it a second time.