#
Update default saved search schedule
Optional
The default saved search runs every hour to update and continually build the SentinelOne assets. To update the default schedule perform the following steps:
- (In Enterprise Security) Navigate to Configure > Content > Content Management.
- Type "SA-SentinelOneDevices" in the filter text box.
- Click "SA-SentinelOneDevices"
- Update the "Schedule" section as necessary
- If necessary, the retention settings can be modified by changing the "Retention" at the bottom.
- Navigate to Settings > Searches, reports, and alerts.
- Set the "App" dropdown to
SA-SentinelOneDevices
. - Set the "Owner" dropdown to
All
. - Click "Edit" under actions for the search
SentinelOne Devices Lookup - Gen
. - Click "Edit Schedule" and update the schedule and necessary.