cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Who rated this post

L3 Networker

This could be done in a Playbook, or, study teh code in QRadar and create an automation script "wrapper" for the command. In essence, the script would perform the search and return a ScheduledCommand object. This causes it to re-schedule for the next run and when you finally do receive the results (or lack there of) you could optionally change the search criteria and perform the same script again.

 

If you kept the option to achieve this in an automation script, the ScheduledCommand can be used (even with altered arguments) and be kept within your first defined timeout.

Who rated this post