Agents and execution history

Agents are scheduled automation jobs that run per account. The available list is loaded from the application configuration and database.

Agent management

On Agents, review the type, version, status, last execution, next execution, and definition update time. Dates and schedules are shown in the selected account’s time zone. Depending on the agent, you can:

• enable or disable it;
• customize its schedule and time zone;
• save a schedule; and
• choose Run now for an enabled job.

The page provides alphabetical A → Z / Z → A sorting and Tiles / List view switching. Administrators can enable Show system jobs when they need to inspect system-level jobs. Notification agents include report, score report, case summary, and audit report jobs. System and internal jobs do not create account activity notifications.

System jobs and read-only schedules may be visible but cannot be edited. Avoid disabling ingestion or housekeeping jobs without understanding the effect on your account.

Understand the agent card

Each agent card or list row identifies the agent name, type, definition version, status, schedule, last execution, next execution, and definition update time. The status means:

• Healthy — the agent is enabled and has completed at least one execution.
• Awaiting first run — the agent is enabled but has not completed an execution yet.
• Running — an execution is currently running or queued.
• Disabled — the agent will not run on its schedule and cannot be started manually.

The page refreshes automatically every 15 seconds. Use the refresh button when you need an immediate update.

Configure an agent schedule

Only agents marked as having a customizable schedule can be edited. The schedule editor accepts a five-field cron schedule and provides time, day, and month controls. A six-field schedule received from the server is displayed without its leading seconds field. SIEM+ synchronizes saved schedules with the scheduler and uses the selected Schedule timezone when calculating the next execution.

Select a valid Schedule timezone, adjust the schedule, and select Save. Saving also stores the current enabled or disabled state. Read-only or system schedules cannot be changed.

Enable or disable an agent

Use the switch on an agent card to change its account-level enabled state. The switch is unavailable while the agent is running or for system jobs. Disabling an agent stops future scheduled executions, but it does not delete previous execution history. Re-enable the agent before using Run now.

Agent job management

Use agent job management when you need to operate a job immediately, inspect its current execution, or stop work that has not started yet:

1. Select the correct account in the application header. Jobs and execution history are scoped to that account.
2. Open Agents and choose Tiles or List view. Use A → Z or Z → A to locate the job; administrators can enable Show system jobs when required.
3. Check that the job is enabled, its schedule and time zone are correct, and it is not already marked Running.
4. Select Run now. SIEM+ queues one execution for the selected account and displays a confirmation. A disabled agent cannot be run manually, and a second run is rejected while the same job is queued or running.
5. Open History from the agent row or the page header. Filter by agent, status, and start-time range, then select Search.
6. For a queued execution, select Cancel and confirm. Only queued jobs can be cancelled; a running job must finish or fail normally.
7. Review the result or error. JSON results are displayed as readable fields; select the file icon to inspect the raw JSON.

Manual runs are still subject to account job-concurrency limits. If a job remains queued unusually long, refresh History and check for a Cancelled, Failed, or Running status before trying again.

The scheduler monitors overdue executions and can recover an overdue job automatically. If the same job appears to be running twice, wait for the status to refresh before starting another manual run.

Review execution history

Open History to see the latest execution results for configured account agents. Filter by Agent, Status, From, and To, then select Search. Administrators can include system jobs. Available status filters include Running, Succeeded, Failed, Cancelled, and Skipped; queued jobs also expose Cancel. Clear filters returns to the default list. The history shows start, completion, duration, status, and result or error. JSON results are flattened for quick reading and can be opened as raw JSON. It automatically refreshes every 15 seconds, and timestamps use the selected account’s time zone.

Step-by-step: manage an agent job

1. Open Agents and confirm the account shown in the header.
2. If you are an administrator and need system-level jobs, enable Show system jobs.
3. Switch between Tiles and List view if needed, then sort by A → Z or Z → A.
4. Review the agent status, version, last execution, next execution, and definition update time.
5. For an enabled, editable agent, adjust the schedule and Schedule timezone, then choose Save. Read-only schedules cannot be changed.
6. Choose Run now to queue the enabled job immediately. Disabled, running, or system jobs may not allow a manual run.
7. Open History, select an agent if needed, choose a status or time range, and select Search.
8. If the row is Queued, select Cancel only when the job should not start, then confirm.
9. Check the start time, completion time, duration, status, and result or error. Expand JSON results or open raw JSON for technical details.

The manual run appears in history after it starts. Refresh the history page while a job is running.