Scheduled task
4actions
4reasons
1sources
Livestatus
A job Task Scheduler runs on a trigger or a clock.
Identified by: sparklogs.config_change.target, which carries a name.
| Action | Reported by | What that reason says |
|---|---|---|
created | scheduled_task_created on Windows Security event log | A scheduled task was created. |
deleted | scheduled_task_deleted on Windows Security event log | A scheduled task was deleted. |
disabled | scheduled_task_disabled on Windows Security event log | A scheduled task was disabled. The task still exists and no longer runs. |
updated | scheduled_task_updated on Windows Security event log | An existing scheduled task's definition was updated. |
Example
A scheduled task was created.
channel: Security
provider_name: Microsoft-Windows-Security-Auditing
event_id: 4698
event_data.TaskName: \Example\SyncTask
event_data.SubjectUserName: ExampleAdmin
event_data.SubjectUserSid: S-1-5-21-1111111111-2222222222-3333333333-1001
event_data.TaskContent: task definition xml omitted
SparkLogs: scheduled_task_created, Warning, scheduled_task_created: NOTABLE: A scheduled task was created.