The grid view enables you to download job results. Each row displays the metadata of the job and its controls. The metadata shows the job’s ID, current state of the job that had run (running or stopped), comment for the job, host set of the job that had run against when it was created, and the host statistics.
.png "Grid_view1.png")
.png "image5.png") |
You can use the job controls section to start or stop or remove the job altogether. These controls changes based on the current state of the job.
.png "Grid_view3.png")
Note
When a job is removed from HX Server, it cannot be added back again.
Click Download to return the results for the job. When clicked, you are prompted to save the file to the local computer. The results are returned as a single zip file and defaults to the filename “results.zip”. The results.zip file consists of all the hosts that have completed the job till the time download was initiated. Each hosts results are compressed as a zip file and named in the following format:
hostname_xagentid.zip
Within each host’s results.zip file, there are one or more files:
manifest.json
This file is always present in results.zip however, if the zip file is empty, refer to the Downloading job results section.
A JSON document that includes all commands executed because of this job (identified as an array of audits). One or more payloads is present within each command that indicates the filename it corresponds to. Payload files are named with a random identifier that maps to the manifest command results.
Remaining files are payload files (referenced as in the manifest) that has either an issues document or results document.
Issues document (a misnomer as they exist for successful executions) is a JSON document that includes an array of log statements as command, executed on the endpoint. This consists of informational messages such as parameters used, runtime, and so on. It also includes warnings and errors. Also, note that due to the advanced nature of the commands, many forensic artifact parsers produce warning and error statements as they attempt to carve, parse, and extract metadata from the system.
Results documents consist of the metadata extracted from the forensic artifact by the command. Often, this document contain a root element that typically means, there were no results found in the command for this artifact.