---
title: "Create PCAP Job from Event"
method: GET
path: "/connect/joblookup/"
tags: ["Jobs"]
---

# Create PCAP Job from Event

`GET /connect/joblookup/`

Given a TCP or UDP network connection log event, create a PCAP lookup job that would best locate the PCAP from that event.

## Query parameters

- `time` string, required
- `esid` string
- `ncid` string

## Other responses

- `302` — Responds with a Location redirect header when the job was successfully created. Note that this does not necessarily mean that the job will find matching PCAP data.
- `404` — There was no document found that matched the provided input time and document or network community ID
- `500` — Internal SOC error; review SOC logs

## Changes

- **2025-01-26** `68dd01966c8b` — 1 info
  - endpoint added
- **2024-12-10** `ee1120fd1e20` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api/changes/connect/joblookup/get.md)

---

[API](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/0576ce393f8d/schema)