Managing Jobs

Inevitably, there are on-demand or scheduled tasks in NetWitness that take a few minutes to be completed. The NetWitness jobs system lets you begin a long-running task and continue using other parts of NetWitness while the job is running. Not only can you monitor the progress of the task, but you can also receive notifications when the task has completed and whether the result was a success or failure.

While you are working in NetWitness, you can open a quick view of your jobs from the toolbar. You can look anytime, but when a job status has changed, the Jobs icon (netwitness_jobsicon_21x18.png) is flagged with the number of running jobs. Once all jobs are completed, that number disappears.

You can also see the jobs in these two views:

  • In the user Profile Jobs panel, you see the same jobs in a full panel. These are only your jobs.
  • In the System view, users with administrative privileges can view and manage all jobs for all users in a single jobs panel.

The structure of the jobs panel is the same in all views.

Display the Jobs Tray

In the NetWitness toolbar, click the Jobs icon (netwitness_jobsicon_22x21.png).

The Jobs Tray is displayed.

netwitness_jobs_407x262.png
The Jobs Tray lists all recurring and non-recurring jobs that you own, using a subset of the columns available in the Jobs panel. Otherwise the Jobs Tray and the user Profile view Jobs panel are the same. In the Admin System view, the Jobs panel lists information about all NetWitness jobs for all users.

View All of Your Jobs

To see a complete view of your jobs, in the Jobs Tray, click View Your Jobs.
The Jobs panel is displayed. The Query column is available in Version 11.5 and later.

jobs_1231.png

Pause and Resume Scheduled Execution of a Recurring Job

The Pause and Resume options apply only to recurring jobs. You can pause a recurring job that is running; however, it has no effect on that execution. The next execution (assuming the job is still paused) is skipped.

  1. To stop the next execution of a recurring job, in any Jobs panel, select the job, and click Pause.
    The next execution of the job is skipped, and the schedule is paused until you click Resume.

  2. To restart execution of paused recurring jobs, select the job and click Resume.
    The next execution of the job occurs as scheduled, and the schedule for the job resumes.

Cancel a Job

To cancel jobs that are executing or in the queue to execute:

  1. In the Jobs Tray or either Jobs panel, select one or more jobs.

  2. Click Cancel.
    A confirmation dialog is displayed.

  3. Click Yes.
    The jobs are canceled, and the entries remain in the list with a status of canceled.

    If you cancel a recurring job, it cancels that execution of the job. The next time the job is scheduled to run, it executes normally.

Delete a Job

Caution: When you delete a job, the job is instantly deleted from the list. No confirmation dialog is offered. If you delete a recurring job, all future executions are removed as well.

Users can delete their own jobs before, during, or after execution. Administrators can delete any job. To delete jobs:

  1. Select one or more jobs.
  2. Click netwitness_delete.png.
    The jobs are deleted from the list.

Download a Job

When a job has the Download status in the Action column, you can download the result of the job. If you are working in the Investigate view and extract the packet data for a session as a PCAP file or extract the payload files (for example, Word documents and images) from a session, a file is created. To download the file to your local system, click Download.