Scheduled scans in OneView

OneView can run automated scans on your endpoints based on custom schedules. This article shows how to create a scheduled detection or software inventory scan.

Scheduled scans run using the endpoint's system time. Offline endpoints continue to scan based off the last downloaded scan schedule.

Schedules overview

To view the Schedules page in OneView, go to Configure > Schedules. In the upper right, click Search schedules  to display a search bar.

Schedules show as line items with different columns highlighting specific information. These columns are:

• Cadence: The hours or weeks between scheduled scans.
• Created At: When the schedule was first created in OneView. 
• Days: Days of the week the schedule runs.
• Enabled: If the schedule is enabled. 
• Frequency: The frequency of the scheduled scan. 
• Schedule Name: Shows the name of the schedule.
• Start Time: When the scheduled scan starts. 
• Type: Shows the type of scheduled scan.
• Groups: Shows the number of groups assigned to the schedule.
• Site Restricted: Shows if the schedule is available to all sites or restricted to a specific site. This cannot be changed once the schedule is saved.
• Updated At: Shows the date the schedule was last updated.

Create scheduled scan

1. In the left navigation pane, click Configure > Schedules.
2. In the upper-right, click Add schedule .

Schedule type and options

1. Under Schedule type and options, enter a Schedule Name
2. Under Schedule type, select a type of schedule:
   • Detection scan
     1. Select the operating system to enable this scan.
        Note: iOS devices cannot be scanned.
     2. Under General, select the operating systems you want OneView to Quarantine found threats automatically.
     3. For Mac scans, select if you want to Treat Potentially Unwanted Programs (PUPs) as malware by checking the box.
     4. For Windows scans, select a scan method Threat Scan, Hyper Scan, or Custom Scan. For more information on scan types, see Types of scans in OneView.
   • Software Inventory Scan
     • For Vulnerability Assessment customers, you'll see Software Inventory & Vulnerability Scan.

The Software Inventory Scan updates endpoint information in the console. This information is organized in Endpoint Properties on the Endpoints screen. To view Endpoint Properties, go to Endpoints > click an endpoint name. Use the tabs on the Endpoint Properties screen to view details about the endpoint.

For scheduling third-party software updates and operating system patches, click the following links below:

• Update software with Patch Management in OneView OneView
• Apply operating system patch in OneView OneView

Schedule groups

1. In the Schedule groups tab, choose Global (All sites) or select a site. This selection cannot be modified once the schedule is saved.
2. Select available groups from the selected sites to scan.

Note: Revisit and update schedules to include new groups created in OneView assigned with endpoints.

Schedule frequency

• In the Schedule frequency tab, set the following parameters:
  Note: Avoid creating overlapping schedules, as this may cause scans to stack up and run consecutively.
  
  • Frequency: How often the scan occurs. Scans happen using the endpoint's local time zone. 
    • Hourly: Select the number of hours between schedules and the start time.
      Note: Hourly scans are not recommended on mobile endpoints due to battery usage.
    • Daily: Select the starting date and time.
    • Weekly: Select the number of weeks between schedules, the start date and time, and the days of the week to scan.
    • Monthly: Select the start date and time.
  • Run missed schedules as soon as possible: Toggle ON to recover missed scheduled scans due to endpoints being powered off or asleep. The scan automatically starts the next time the endpoint connects to Nebula. 

Delete scheduled scan

1. Check the box for one or more groups.
2. At the top-right of the Groups page, click the ellipsis icon .
3. Click Delete.
4. A confirmation dialog displays. Click Accept to delete.