---
title: "Create PCAP Job from Event"
method: GET
path: "/connect/joblookup/"
tags: ["Jobs"]
---

# Create PCAP Job from Event

`GET /connect/joblookup/`

Given a TCP or UDP network connection log event, create a PCAP lookup job that would best locate the PCAP from that event.

## Query parameters

- `time` string, required
- `esid` string
- `ncid` string

## Other responses

- `302` — Responds with a Location redirect header when the job was successfully created. Note that this does not necessarily mean that the job will find matching PCAP data.
- `404` — There was no document found that matched the provided input time and document or network community ID
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/0576ce393f8d/schema)