You have a Microsoft Sentinel workspace named Workspace1 and a firewall named FW1. FW1 logs are ingested into Workspace1. Typically, firewall events are ingested approximately two minutes after the event occurs, and occasionally up to five minutes after. A scheduled analytics rule runs every five minutes and queries the TimeGenerated value for the last five minutes. You need to minimize missed detections caused by ingestion delays and prevent duplicate alerts across rule runs. How should you change the analytics rule query?
Select one answer.
Purchase Full Access to view answer options & explanation
The first 125 questions in this bank are completely free. Unlock Full Access on the exam page to view all answer choices, verified answers, explanations, and community discussions for all 415 questions.
