Reviewing the Scheduled Investigation History

Procedure

1. Access the Scheduled Investigation History screen:
   1. Go to Response → Live Investigation.
   2. On the Scheduled Investigation tab, click a value in the Name column.
2. Review the details listed in the schedule overview:
   • Task name: Name given to the schedule
   • Period and frequency: Shows when and how often the schedule runs the investigation.
   • Method: Criteria used for each run of the schedule. Click to show the full criteria.
   • Target endpoints: Click to view the list of endpoints included in the schedule.
3. Review the investigation details for each run of the schedule.

   Column Name	Description
   Status	Current state of the investigation
   Progress	Percentage of completion of the investigation
   Matched Endpoints	Number of endpoints that contain an object matching the specified criteria Click to open the Investigation Results screen.
   Started	Date and time the investigation started
   Elapsed	Time elapsed since the start of the investigation For completed investigations, total time spent running the investigation

4. Select at least one investigation to enable the following options:
   • Stop: Cancels the investigation. Stopped investigations cannot be resumed.
   • Delete: Stops the investigation, and then removes the investigation from the list. Removed investigations cannot be recovered.