Run a Worker on demand
A Worker normally runs on its own schedule. You can also start a run yourself, for example to see the effect of a settings change without waiting for the next scheduled run. You start the run from the Workflows page, because each Worker is a managed workflow.
- Turn the Worker on. A Worker that's turned off can't be run. Refer to Configure Worker settings > Turn a Worker on or off and view its runs.
- Turn on the Show managed workflows advanced setting. Managed workflows are hidden by default, and the Workflows page can't show a Worker while they're hidden. Refer to Set up Workflows > Show managed workflows.
- Make sure your role includes the privilege to run workflows. Refer to AlertZero privileges.
A run that you start from the workflow list is an extra run, in addition to the scheduled ones. The Worker still runs on its schedule, and the extra run produces the same kinds of results as a scheduled run, such as proposed actions and investigations.
A run that you start uses the same autonomy level as a scheduled run, with one exception: the Endpoint Analysis Worker. When you run it yourself, it always uses Manual autonomy, even if you set it to Supervised. Any containment proposed actions that it creates wait for your approval.
- Find Workflows in the navigation menu or use the global search field.
- Select View, then select Managed so that managed workflows appear in the list.
- In the workflow list, find the Worker.
- In the Worker's row, select Run .
To check the result of the run, refer to View execution history.
Start the run from the workflow list, not from the workflow editor that View executions opens. A run that you start in the editor is a test run, which is meant for trying out a workflow while you author it, not for production runs. For more information, refer to Use the YAML editor > Test runs and production runs.