Scheduled scans in OneView

OneView OneView can run automated scans on your endpoints based on custom schedules. This article shows how to create a scheduled detection or software inventory scan.

Scheduled scans run using the endpoint's system time. Offline endpoints continue to scan based off the last downloaded scan schedule.

Schedules overview

To view the Schedules page in OneView, go to Configure > Schedules. In the upper right, click Search schedules  to display a search bar.

Schedules show as line items with different columns highlighting specific information. These columns are:

• Created At: When the schedule was first created in OneView. 
• Enabled: If the schedule is enabled. 
• Frequency: The frequency of the scheduled scan. 
• Schedule Name: Shows the name of the schedule.
• Start Time: When the scheduled scan starts. 
• Type: Shows the type of scheduled scan.
• Groups: Shows the number of groups assigned to the schedule.
• Site Restricted: Shows the sites the schedule is available for.
• Updated At: Shows the date the schedule was last updated.

Create scheduled scan

1. In the left navigation pane, click Configure > Schedules.
2. In the upper-right, click Add schedule .

Schedule type and options

1. Under Schedule type and options, enter a Schedule Name
2. Under Schedule type, select a type of schedule:
   • Detection scan
     1. Select the operating system to enable this scan.
     2. Under General, select the operating systems you want OneView to Quarantine found threats automatically.
     3. For Mac scans, select if you want to Treat Potentially Unwanted Programs (PUPs) as malware by checking the box.
     4. For Windows scans, select a scan method Threat Scan, Hyper Scan, or Custom Scan. 
   • Software Inventory Scan
     • For Vulnerability Assessment customers, you'll see Software Inventory & Vulnerability Scan.

The Software Inventory Scan updates endpoint information in the console. This information is organized in Endpoint Properties on the Endpoints screen. To view Endpoint Properties, go to Endpoints > click an endpoint name. Use the tabs on the Endpoint Properties screen to view details about the endpoint.

For scheduling third-party software updates and operating system patches, click the following links below:

• Update software with Patch Management in OneView OneView
• Apply operating system patch in OneView OneView

Schedule groups

1. In the Schedule groups tab, choose Global (All sites) or select a site.  
2. Select available groups from the selected sites to scan.

Schedule frequency

1. In the Schedule frequency tab, set the following parameters:
   
   • Schedule: Choose either Hourly, Daily, or Weekly.
     • Hourly: Select between 1 and 24 hour(s) from this drop-down.
     • Daily: Daily scans initiate on the start date selected if the start time hasn't been reached. 
     • Weekly: Weekly scans initiate on the same day each week for the selected start date and time. 
   • Start Date: Click to select a calendar start date for this scheduled scan.
   • Start Time: Click to select the starting hour, minute, and AM/PM option for this scheduled scan.
2. Under Recovery Options, toggle on Run missed scans as soon as possible to recover missed scheduled scans due to endpoints being powered off or asleep. This scan automatically starts when the endpoint connects to OneView. 

Delete scheduled scan

1. Check the box for one or more groups.
2. At the top-right of the Groups page, click the ellipsis icon .
3. Click Delete.
4. A confirmation dialog displays. Click Accept to delete.