deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-16 02:43:43 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge pull request #9157 from anvascon/patch-9

Browse Source 
Lookback window for modified queries
This commit is contained in:
Daniel Simpson
2021-02-17 21:31:27 -08:00
committed by GitHub
parent 315d724e82 3ea4da1c0d
commit 20f65ba155
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md
View File

@ -93,6 +93,10 @@ When saved, a new custom detection rule immediately runs and checks for matches
- **Every 3 hours**—runs every 3 hours, checking data from the past 6 hours
- **Every hour**—runs hourly, checking data from the past 2 hours
> [!IMPORTANT]
>When changing a query that is already scheduled as a Custom Detection, it's next immediate execution will have a lookback window of 30 days, exactly as if a new query was being created.
>Changes to a large number of queries, and with time filters higher than the default lookback durantion for the selected frequency, might have an impact in the overall quota consumption of Advanced Hunting and resulting in exhausting the daily quota.
> [!TIP]
> Match the time filters in your query with the lookback duration. Results outside of the lookback duration are ignored.