What's the interval of reporting data collected on clients to cloud for EDR sensor?

Question

Hi,&nbsp;Defender EDR collects data from client, such as process creation, network connection, user logon. How much time does it take for these data to be stored in Threat hunting tables?Is there a setting that can be used to change the frequency?&nbsp;Thanks.

mas18 · Answer

NathanZ0202&nbsp;You can find "Expedite telemetry reporting frequency" options in intune and configmgr.In MDE portal, Endpoint - Timeline section will have almost real-time telemetry data that can also be used for investigation. I don't think there is specific option for reporting frequency for threat hunting. Sometime(I experienced) It may took around 8 hours to have updated data in MDE tenant.

nathanz0202 · Answer

Thank you.I also experienced a latency of 30 minutes to get a command line record. Just wondering it is unacceptable if I get data so late.

kraken85 · Answer

https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/optimized-reporting-latency-and-expedite-mode/ba-p/229208

Forum Discussion

What's the interval of reporting data collected on clients to cloud for EDR sensor?

3 Replies