Following a recommendation to create a task

To follow a recommendation to create a task:

1. Click Create task, and in the recommendation box, expand the list of task types.
2. Select a task type:
   • Kill process
   • Get forensics
   • Start YARA scan
   • Service management
   • Get process memory dump
   • Get NTFS metafiles
   • Run application
   • Get file
   • Delete file
   • Quarantine file
   • Restore file from quarantine

   This opens the task creation window with preset values (for example, host name, file path, MD5 or SHA256 hash of the file) from the event you are working on.

3. If you want to modify preset values from the event, edit the corresponding fields.
4. If you want to add a comment for the task, enter it in the Description box.
5. If you are creating a Kill process, Delete file, Start YARA scan, or Service management task and you want to modify the scope of the task, change the value of the Task for setting:
   • If you want to run the task on all hosts of all servers, select the All hosts option.
   • If you want to run the task on selected servers, select the Specified servers option and on the right of the Servers parameter name select the check boxes next to the names of the servers on which you want to run the task.

     This option is available only when distributed solution and multitenancy mode is enabled.

   • If you want to run the task on selected hosts, select the Specified hosts option and list these hosts in the Hosts field.
6. Click Add.

The task is created.

Information about the created task is displayed in the Tasks section of the web interface.

Users with the Security auditor and Security officer roles cannot create tasks.