When Actions, Sequences, Evaluations, or Monitors are run, they become Jobs. You can view Jobs and their results in a number of ways.
You can also generate HTTP/HTTPS or syslog notifications to send to a specified destination that ingests machine data, such as Splunk or Elasticsearch, by selecting the Notification Formats menu option.
You can access these Job features by going to the Jobs menu on the navigation bar.
The Validation Platform supports parallel Job execution, with the following limitation:
- When an Actor is involved in multiple Jobs, the Jobs will be queued in the order they are received.
This limitation means any Actors queued for Job one will be unavailable to Job two until Job one is complete, therefore queuing all Job two Actions. Jobs may contain one or more Job Actions, which involve up to two Actors.
The Job Status page displays all Jobs in the system by default. From the Job Status page, you can view and export Jobs, cancel a Job that is currently running or preparing to run, publish individual or multiple job results to a pipeline destination (if you have the correct permissions), and delete a Job (if you have the correct permissions).
Job Status
Each Job shows:
- Job ID
- Name of the Action, Sequence, or Evaluation
- Status (Running, Sleeping, Preparing, Waiting, Canceled, Completed, Errored)
- Who ran it (Ran by)
Supported Actions (Endpoint, Network, Host CLI, and so on) also show the Action User Profile used in an Action. If no Action User Profile was selected, this appears as the default "User: System". You can click on the associated Action User Profile to quickly navigate to the Action User Profiles page of the platform.
- When it ran
- The groups of Actions included in the Job
Each group includes:
- The source Actor and Zone
- The destination Actor and Zone
- The number of Events blocked
- The number of Events detected
The group can also be expanded to show:
- The Actions included in the group
- If the Action was Blocked or Not Blocked
- How many Events are related to each Action
From the Job Status page, you can also Export all Jobs, View the Job, Cancel a Job that is currently running or preparing to run, select Jobs to view results in the Summary Dashboard, and Delete a Job (if you have the correct permissions). Another option allows you to select All Jobs on a page, show a Job selection option next to each Job, and then delete all the Jobs that you selected. Using the Select All option only selects the Jobs that are currently displaying on the page (Jobs 1-40 of 120, for example).
Clicking on a Job, or clicking View for that Job, opens the Job details page. For more information on the information available, see Understanding Job Results.
You can filter Jobs as described in Filtering Jobs.
Order of Execution for Jobs
Jobs will run in the order they were submitted, if the Actors are available. Otherwise, when a Job runs is determined by the availability of Actors required by the Jobs. This means Jobs that don't use the same Actors can run at the same time. For example, three jobs are submitted in this order: Job1 - Actors A & B, Job 2 - Actors B & C, Job 3 - Actors C & D. Based on the order the Jobs were submitted and the Actors involved, Job 1 & Job 3 can run at the same time and Job 2 won't start until both Jobs have completed.
Grouping of Actions and sleep Actions in a Job also impacts when a Job can start. For example:
- A Job has 4 groups of Actions and an Actor required for another job is only used in Group 1. When the Actions in Group 2 start, that Actor is free to be used by the other Job.
- A queued Job uses the same Actors as the Job for a Sequence that includes a sleep Action. The queued Job starts when the first Job starts its sleep Action.
TIP: System Jobs, such as CTTA, are included in the Job Queue and can also run while other Jobs are running, if the Actors required are not being used by other Jobs.