View the lookup queue

When lookup requests have been submitted to a third-party integration, the requests are queued so as not to overload system resources. You can view the status of queued requests, as needed.

Before you begin

Role required: sn_ti.admin

About this task

In the list of queued lookups, each lookup includes an automatically generated lookup name that identifies the file, hash value, URL, or IP address in the lookup.

Procedure

  1. Navigate to Threat Intelligence > IoC Lookup > Lookup Queue.
    All lookup requests that have been submitted are shown in a list. The State column shows the current state of each queued entry. A state of Complete indicates that the lookup has left the queue. It does not necessarily indicate that the lookup has completed processing. When the lookups have been completed or if they have failed, the Processing column shows the appropriate work notes text.
    Note: If a hash value was submitted for lookup and the lookup source fails to find a result, the State shows Complete and the work note in the Processing column indicates Unknown.
  2. After a lookup has finished processing, click a queued record to view details for the lookup request.