Multi-Site Data Ingestion Schedules

Last updated: October 19, 2026

Overview

Multi-site data ingestion schedules let you set up event ingestion for many client sites in one pass: select several connections in the schedule dialog, and D3 creates one schedule per connection—each named after its site, each with its own Attack Path Discovery (APD) setting—instead of you filling in the same form once per site.

Because a connection already belongs to exactly one site, choosing ten connections means ten sites are covered. There is no separate bulk tool to learn: select one connection and the dialog works the way it always has; select two or more and it switches to multi-site mode.

Multi-site scheduling is found under Configuration > Automation > Data Ingestion, in the new UI, on the Event Intake tab.

In short

Before You Start

A multi-site batch builds on connections you already have, so set those up first.

• One connection per site. Each site you want to ingest from needs its own connection for the integration. If a single connection is shared to many sites today, clone it to each site first—see Connections.

• Editor access to each connection. Connections you can only view are listed but cannot be selected, because a schedule cannot be saved on them.

• APD permission, if you want APD. Turning on APD for new schedules requires the Edit APD Disposition Rules permission. Without it, the schedules are still created, without APD, and the APD card says so.

Choosing Connections

The Connection field is where a batch starts: every connection you select becomes one schedule for that connection's site.

The list shows only the connections of the integration selected in the Integration column, grouped by site category and searchable. Each entry reads as the connection name followed by its site in parentheses—for example, FortiSIEM - Contoso (Contoso Health). Select All at the top of the list picks every connection shown, which is the quickest way to schedule a whole group. Selecting a different integration clears the selection.

Some entries behave differently, so a batch never creates something you did not mean to:

As soon as two or more connections are selected, three counts appear under the field—for example 5 selected, 4 will be created, and 1 inactive · skipped—so you know how many schedules you are about to make before you go any further.

Naming the Schedules

A schedule name pattern names every schedule in the batch after its own site, so forty new schedules do not all arrive in the Data Ingestion tree as forty rows called "Fetch Event".

The field appears only when two or more connections are selected. Type plain text and any of these placeholders, which are filled in for each site:

The default pattern is {integration} — {site}. Preview under the field shows the name the first selected connection will get, so you can see the result as you type—for example, the pattern {site} {integration} events previews as Contoso Health FortiSIEM events.

Names are limited to 50 characters; a longer result is shortened to fit. Any single name can still be changed on the review step.

Spreading Start Times

Stagger start times across the interval spaces the batch's start times evenly across one polling interval, so schedules created together do not all query the data source at the same moment and run into the vendor's API limits.

The line under the checkbox shows what the current choice does—for example, 4 schedules spread over 5 min ≈ one every 75 s, or All 4 schedules will start at the same time when it is cleared. Each schedule keeps the same interval afterwards; only the first start is spread.

Shared Settings

Everything else in the dialog—Interval (Minutes), Ingestion Failure Process, Additional Settings, and Command Details—is filled in once and applied to every schedule in the batch. Required Command Details fields, such as a search condition, must be filled in before you can review the batch.

When any selected connection is shared to client sites, the site-mapping fields appear as they do for a single connection, and apply to those connections only.

Setting the APD Default

The Attack Path Discovery (APD) card sets one APD choice for the whole batch, so you do not have to enable APD and set up its rules on each schedule afterwards. It is a default: on the review step you can turn APD off for any single site—for example, to start a newly onboarded client in observation while the others run your standard policy.

Switch on Enable APD for all N schedules, where N is the number that will be created. When there is nothing else to choose, every new schedule starts with an empty rule set. When there is a choice, pick where the new schedules' rules come from:

Copy rules from appears only when a schedule of the same integration is available to copy from, and Use an SOP only when there is an SOP to pick. Leaving the switch off creates every schedule without APD; you can still turn it on for any of them later.

Creating Schedules for Multiple Sites

This procedure creates one schedule for each selected site, with an APD default and one site left in observation.

1. Navigate to Configuration > Automation > Data Ingestion, and stay on the Event Intake tab.

2. Select New, then Schedule.

3. Under Integration, select the integration—for example, FortiSIEM. Command fills in with the integration's fetch command.

4. In Connection, select the connections for the sites you want to schedule.

5. (Optional) Change Schedule name pattern, and check Preview.

6. Enter Interval (Minutes).

7. (Optional) Select Stagger start times across the interval.

8. Fill in any other shared settings, including the required Command Details fields.

9. (Optional) Under Attack Path Discovery (APD), switch on Enable APD for all N schedules, and choose where the rules come from.

10. Select Review N schedules.

Reviewing the Batch

Review Schedule Jobs is a last look at every schedule before it exists: one row per site, with the name it will get, the connection it uses, its APD setting, and whether it will be created.

The counts at the top restate how many rows are selected, will be created, and are skipped. Select Back to change anything on the form; your name edits and APD switches are kept when you return.

1. Edit any Schedule name that should differ from the pattern.

2. (Optional) Switch off AI disposition rules for any site that should start without APD.

3. Select Create N schedules.

4. Read the confirmation, then select Create.

The confirmation appears only when at least one schedule will have APD. Its last line says when APD starts working: after you publish a Disposition Rule for each schedule (empty rule set), or straight away (copied rules or an SOP).

Reading the Result

Schedule Jobs Created reports what happened to each site, so you know which schedules exist without opening the tree.

Each row's Result is one of:

Created schedules are live immediately, and a failed row does not undo the others. When part of the work behind a created schedule did not complete, the row says so after Created:

When any row failed, Retry N failed runs just those rows again. Rows that were created are not touched.

Select Done to close the dialog. The new schedules appear under the integration in the Data Ingestion tree, each with its site, connection and interval. Schedules created with APD carry the AI sparkle icon.

Creating a Schedule for One Connection

With a single connection selected, the dialog keeps its familiar form: there is no name pattern, no review step, and Add Schedule saves the schedule directly.

One thing is new: you can turn on APD while you create the schedule, rather than only after saving it. Switch on Enable APD when this schedule is created in the APD card, then select Add Schedule. A Create schedule with APD? confirmation states that APD can't be turned off after the schedule is created, and whether APD starts straight away or waits for you to publish a Disposition Rule.

Messages You May See

RELATED ARTICLES

• Data Ingestion

• Connections

• Attack Path Discovery