deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-18 11:53:37 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Lookback window for modified queries

Browse Source 
Note on lookback window when Custom Detections are changed and how that can impact the AH CPU quota from a customer tenant.
This commit is contained in:
António Vasconcelos
2021-02-17 16:11:17 +00:00
committed by GitHub
parent 57ceb89b65
commit 3ea4da1c0d
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md
View File

@ -91,6 +91,10 @@ When saved, a new custom detection rule immediately runs and checks for matches
- **Every 3 hours**—runs every 3 hours, checking data from the past 6 hours
- **Every hour**—runs hourly, checking data from the past 2 hours
> [!IMPORTANT]
>When changing a query that is already scheduled as a Custom Detection, it's next immediate execution will have a lookback window of 30 days, exactly as if a new query was being created.
>Changes to a large number of queries, and with time filters higher than the default lookback durantion for the selected frequency, might have an impact in the overall quota consumption of Advanced Hunting and resulting in exhausting the daily quota.
> [!TIP]
> Match the time filters in your query with the lookback duration. Results outside of the lookback duration are ignored.