After editing an EDR:C channel that has run, the channel will not run again until the next day

Products

• Endpoint Detection and Response Cloud

Issue/Introduction

In Endpoint Detection and Response: Cloud 3.x, you edit a channel that is scheduled to run later that day. You then look for results after the scheduled run time, but it was not run as expected. If you check back the next day, you will see that the channel did run at the configured time.

Cause

There are several options for configuring a channel schedule, Run Once (next vault checkin), Run Once At (specific time), Repeat At (time), Repeat Every (interval).

When using Repeat Every, Last Scan Time = the last time the scan completed. If the channel is edited within the time interval between last scan and the current interval, it won’t rescan until the new interval has passed.

Resolution

This is the expected behavior, as a failsafe to minimize service disruptions for our other customers sharing the same cloud.

If you wish to run the scan immediately, use the channel context menu and click run now.