Managing tasks

Users with the Senior security officer role creating tasks on a server have unlimited (root) access rights for all hosts with the Endpoint Agent component that are connected to that server.

In the web interface of the application, users with the Senior security officer role can manage files and applications on hosts by creating and removing tasks.

In distributed solution and multitenancy mode, Kill process, Get forensics, Get registry key, Start YARA scan, Service management, Run application, Delete file, Restore file from quarantine, Quarantine file tasks can have one of the following types:

• Global—Created on the PCN server. These tasks apply to hosts that are connected to this PCN server and to all SCN servers that are connected to this PCN server. Tasks belong to the tenant for which the user is managing the program using the web interface.
• Local—Created on the SCN server. These tasks apply only to hosts that are connected to this SCN server. Tasks belong to the tenant for which the user is managing the program using the web interface.

Get file, Get process memory dump, Get NTFS metafiles, Get disk image, Get memory dump tasks run only on the specified host, regardless of the application operating mode.

The maximum task execution time is 24 hours. If the task did not complete in this time, execution is paused.

Users with the Senior security officer role can manage all tasks for tenants to whose data they have access.

Users with the Security officer role do not have access to tasks.

Users with the Security auditor role can view the task table and information about the selected task.

In this section Viewing the task table Viewing information about a task Creating a get file task Creating a forensic collection task Creating a registry key retrieval task Creating an NTFS metafile retrieval task Creating a process memory dump retrieval task Creating a disk image retrieval task Creating a RAM dump retrieval task Creating a process termination task Creating a task to scan hosts using YARA rules Creating a service management task Creating an application execution task Creating a file deletion task Creating a file quarantine task Creating a quarantined file recovery task Creating a copy of a task Deleting tasks Filtering tasks by creation time Filtering tasks by type Filtering tasks by name Filtering tasks by file name and path Filtering tasks by description Filtering tasks by server name Filtering tasks based on the name of the user that created the task Filtering tasks by processing status Clearing a task filter

Page top