Scheduling¶
Any test can run automatically on a schedule. Set it in the Schedule section of the test's form:
| Field | Key | Notes |
|---|---|---|
| Cron expression (UTC) | schedule_cron |
A standard 5-field cron expression. |
| Run on schedule | schedule_enabled |
The schedule only runs while this is on and the test is Enabled. |
The test page shows the next scheduled run, or Not scheduled.
Cron format¶
┌───────────── minute (0–59)
│ ┌─────────── hour (0–23, UTC)
│ │ ┌───────── day of month (1–31)
│ │ │ ┌─────── month (1–12)
│ │ │ │ ┌───── day of week (0–6, Sunday = 0)
│ │ │ │ │
* * * * *
| Expression | Runs |
|---|---|
*/5 * * * * |
Every 5 minutes (the most frequent allowed) |
*/15 * * * * |
Every 15 minutes |
0 * * * * |
Hourly, on the hour |
0 2 * * * |
Daily at 02:00 UTC |
30 6 * * 1-5 |
Weekdays at 06:30 UTC |
0 0 1 * * |
Monthly, at midnight UTC on the 1st |
Rules¶
- UTC only. Convert local times to UTC. For example, 09:00 in New Zealand standard time (UTC+12) is
0 21 * * *, the previous day. - At least 5 minutes apart. An expression that would run two consecutive times less than 5 minutes apart is
refused when you save, so
* * * * *and*/2 * * * *are not allowed. - Missed runs aren't caught up. If a scheduled time is missed, for example while your tenant was locked or the test was disabled, Helena runs at the next scheduled time and does not catch up on the ones it missed.
- Locked tenants don't run. Scheduled runs pause while your subscription doesn't allow access, and resume when it does.
Scheduled runs appear in the Test Log with trigger schedule and actor System.
Tips¶
- Schedule negative tests too. A target that starts accepting expired tokens or revoked clients after a config change is exactly what you want to find out about first.
- For the SIEM REST API Poll test, match the schedule to your real collector's
polling interval (often
*/5 * * * *). With the Everything since the last passed run window, this gives you continuous coverage with no gaps. - Spread heavy tests across the hour (
7 * * * *,23 * * * *) instead of scheduling everything at0.