When you have TAAM, regular PCAP-based Actions that include HTTP traffic can be run as a Captive IOC Action.
- Within the Director, go to Library > Actions.
You can use the Filters (any mix of Tags, Content Source, Last Run Status with AND/OR operators), or search functionality to help identify the specific content that you want to run. You can use the Sort By option to reorder the results by Name, VID, Modified, Last Added, Last Run, or Total Runs.
Identify a PCAP-based Action you want to run and click Run as Captive IOC-PCAP
. This opens the Job Definition window and automatically expands the runtime parameters.
Job Definition for regular PCAP Action run as Captive IOC
- (Optional) Modify the runtime parameters.
- Select your Source and Destination Actors.
- (Optional) If necessary, select the Captive IOC Proxy.
- Click Run Now. The Job page appears and the Action group includes the Captive IOC - PCAP logo.
. This opens the Job Definition window and automatically expands the runtime parameters.
Job for standard PCAP Action run as Captive IOC