Time Delay For Baseline Execution

1

When leveraging a Baseline as a Policy Action, what’s the most efficient way to establish a time delay in the relevance to delay execution?

2

How much are you looking to delay? Is it something that the current stagger portion of an action (below)

image
image797×138 2.23 KB

does not accomplish?

You could add a line of relevance like

(minute_of_hour of current time_of_day as integer) = (computer id mod 60)

That would randomize the computers into 60 groups, 1 group per minute.

1 Like
3

Jared-

What I’m looking to put into place is that an endpoint will have to be reporting in for 8 hours before it becomes eligible to receive the actions in the baseline.

Thanks,
Tim

4

@TAK9847, it sounds like you want to implement command polling for the endpoints in question.

5

I got it tweaked in the applicability part of the Baseline…thanks!

6

Curiously, what relevance did you end up using?