In Endpoint Detection and Response: Cloud 3.x, you edit a channel that is scheduled to run later that day. You then look for results after the scheduled run time, but it was not run as expected. If you check back the next day, you will see that the channel did run at the configured time.
There are several options for configuring a channel schedule, Run Once (next vault checkin), Run Once At (specific time), Repeat At (time), Repeat Every (interval).
When using Repeat Every, Last Scan Time = the last time the scan completed. If the channel is edited within the time interval between last scan and the current interval, it won’t rescan until the new interval has passed.
This is the expected behavior, as a failsafe to minimize service disruptions for our other customers sharing the same cloud.
If you wish to run the scan immediately, use the channel context menu and click run now.
Subscribing will provide email updates when this Article is updated. Login is required.