Forum Discussion

Brass Contributor

May 29, 2019

[DETECTION] 'Frequency', 'Period', and 'Suppression' precision

Hello, I would like to have more details about the 'Frequency', 'Period', and 'Suppression' parameters. Here is what I understand: Frequency - No problem with this: the query is run every X mi...

GaryBushey

Bronze Contributor

May 30, 2019

Molx32 The Period is used just like its description states, it is the time period for your data. If you look under the "Set alert query" heading above where you enter your query it does state "Set time and interview parameters only using the Period field under Alert scheduling."

So it appears that MS does not want any sort of time parameter in the query itself. Hopefully someone from MS can state why that is.

CliveWatson
Former Employee
May 30, 2019
GaryBushey

Its related to https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-unified-log

"The query returns only records that were created within this range of the current time. Time period restricts the data fetched for log query to prevent abuse and circumvents any time command (like ago) used in log query. " 24hrs is the max.