Blog Post

Microsoft Sentinel Blog
4 MIN READ

Handling ingestion delay in Azure Sentinel scheduled alert rules

romarsia's avatar
romarsia
Former Employee
Jan 12, 2021
  At Azure Sentinel we take pride in the ability to ingest data from a variety of sources(learn more). However, data ingestion time may vary for different data sources under different circumstanc...
Updated Jan 12, 2021
Version 2.0
analytics
romarsia's avatar
Former Employee
Joined January 04, 2021
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is an industry-leading SIEM & AI-first platform powering agentic defense across the entire security ecosystem.

luizao_lf's avatar
luizao_lf
Copper Contributor
Apr 04, 2021


Very good content, romarsia .

Thanks.

I have a doubt.

 

The timegenereted() is the time that the event was generated at the source and is informed in the source payload, right?

 

If for some reason my source does not send the time the log was created, what will be the timegenereted time?

 

If I'm not mistaken, for the MMA collector, if I don't have the timegenereted specified in the log, I'll specify _TimeReceived, which is the time that the log arrived at the installed agent. That's it?

 

What would it be like for firewall logs, for example?