Write jobs

Supported in:

The Jobs Scheduler page contains default Google Security Operations jobs, as well as jobs that are created in the IDE and are scripts that can bescheduled to run periodically. Jobs can access data in all environments.

The following predefined jobs are available:

Option Description
Actions Monitor Notifies if a specific action has failed at least three times, across all cases it was performed in (to a predefined email, as set in the Siemplify integration configuration in the Google SecOps Marketplace.)
Connectors Monitor Notifies regarding any Connectors errors in the alert ingestion process.
Machine Resource Utilization Notifies if the machine resource utilization is close to full usage, according to the following default rules:
CPU – over 90%
MEM – over 85%
Drive – over 80%.
ETL Notifies regarding any error in the ETL alert ingestion process.
Jobs Monitor Notifies if a specific job has failed at least three times (sends a notification for each specific job once every three hours).

Configure a new job

Before you can configure a new job, you must first create its script in the IDE. For detailed instructions on creating jobs in the IDE, see Using the IDE.

To configure a job, follow these steps:

  1. In the left navigation, go to Response > Jobs Scheduler. The Jobs Scheduler page appears.
  2. Select add Create new job.
  3. Select the job you created in the IDE.
  4. Optional: Select the Remote Agent checkbox.
  5. Click Save.
  6. Click the job to open its properties.
  7. In the Job Scheduler section, select a Schedule Type:
    • Basic: Interval-based scheduling (for example, every 5 minutes).
    • Advanced: Calendar-like options and more precise control. See Advanced scheduling for more information.
  8. Click Save to finalize the job creation.
  9. Optional: Click Run Now to run the script immediately.

After you configure and save your job's schedule, the Jobs Scheduler page displays a Next Job Execution date and time in your local time zone.

Advanced scheduling

If you select Advanced as the schedule type, you can configure the job using the following options:

  • Run Once: Schedule the job to run only one time at a specified future date and time.
  • Daily: Schedule the job to run at the same time each day.
  • Weekly: Configure the job to run on specific days of the week.
  • Monthly: Schedule the job to run on specific days of the month.
    • If you select a date (such as the 29th, 30th, or 31st) that does not exist in a particular month, the job will be skipped for that month.

For recurring events that repeat every X interval, the starting date sets the first interval. The first interval will be the day/week/month of the starting date (regardless if it was actually run or not), and the second interval will be X days/weeks/months after.

For example, if you schedule a recurring interval for Monday, Wednesday every two weeks, and you start on a Tuesday, the job will run on Wednesday, skip one week, and then run on Monday, Wednesday from there on.

Additionally, configure the following parameters:

  • Run at: Specify the exact time of day for the job to run.
  • Time zone: You can specify the time zone for your job's schedule. The job will run according to the time in the time zone you configure for it, regardless of your personal user preferences time zone or the platform's default time zone. Select the relevant time zone from the provided menu during job configuration.
  • Starting at: Select a future date and time from which the job schedule begins.

Need more help? Get answers from Community members and Google SecOps professionals.