log lags and analytic rules

Question

hi kind community!

I am new to sentinel, so I wanted to ask about the delays of the log creation and injections in to sentinel. take AAD login logs for example, there is usually a delay for the logs to be generated and passed through the sentinel. so if I have a analytic rules that query logs every 30 mins, if the lag is greater than 30 mins, is that meaning the rules will never be satisfied. looking forward hearing from the community!

cheers

Answer 1

@HUI ACE Thanks for reaching out.

The longer is delay is only at first time, when we send the logs while adding the connector. After that the logs are ingested as soon as the respective service generates it. Within 5 minutes in case of Azure AD (not at the first time) But yes, the logs need to be present in order for the analytic query to work and find on something.

In that case you need to schedule your query accordingly. However, do let us know if you think few logs take more time to sync to Sentinel LAWS.

For that you do have query options which you can set for different time frames while creating an analytic rule

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.