Create a data collection schedule

Purpose

This article outlines how to create a collection schedule on a collector client that will ensure continuous data collection. BHE administrators should use it when deploying a new client or adding an additional schedule to an existing client.

Generally, Azure and Active Directory Structure do not change significantly enough to warrant more than daily collection.  Local Groups and Sessions can be scheduled to collect every 7 hours to ensure a good sampling of round-the-clock activity.

Prerequisites

• Creation of one SharpHound Enterprise client, see Create a SharpHound Enterprise collector client
• Logged in as a user role which is authorized to modify clients, see User Role Definitions

Process

1. In the top right, click settings ⚙️ → Administration

2. In the top left side, click Manage Clients

3. On a client, click the burger menu and select Edit Client

4. In the Edit SharpHound Client window, under the heading Collection Schedule, click the + icon to add a new schedule.

5. In the Schedule window, configure the schedule:
   • Start Date: The time on which the first collection should run
   • Frequency: The frequency of the schedule
   • Data: The type of data the schedule collects, see SharpHound Enterprise Data Collection and Permissions
   • Advanced Options: See the Scanning section in the article SharpHound Enterprise Tenant Configuration

6. Save the schedule by clicking Save
7. Save the collector client by clicking Save

Outcome

The client is now configured for continuous data collection with one schedule. You can add multiple schedules to a single client for more granular control.

A brief of a client’s schedule is shown in the client table’s column Collection Schedule.

After the next schedule, see the job’s status in the Finished Jobs Log by clicking ⚙️ → Administration, and in the top left side, click Finished Jobs Log_. _The columns Status and Status Message report on the job’s completion.