Forum Discussion
What is leading? Query scheduling? Or the lookback in the query?
Hi,
For an Analystic rule (scheduled KQL query), I can set the Query scheduling -> Lookup Data From Last X time:
However, for a sub-query, I want to perform a lookback of the data for the last 7 days.
Is this possible? Which lookback is leading? The one set in the query config, or the one set in the query?
I couldn't find my answer in the documentation :')
ceesmandjes The Query scheduling take precedence over the KQL Query that was entered. There used to be a message when creating/editing an Analytic rule that stated it but it seems to be gone now. The one that is there now is a bit confusing.
Good night, GaryBushey
Maybe you can help me.
I am having some information conflicts in this regard.
In the incident [52080], the first alert generated informs that the search frame is in 2 hours retroactive, as it was configured in the rule in 2 hours retroactive.
In the query, a 20-minute retroactive team was defined.
When entering the event log, when going to Time Range, the 2-hour retroactive time is configured, as configured in the rule, being the same value found in [Time Frame] when the incident was generated. So far, everything as expected.
From here the confusion begins with information.
Upon entering the logs of the generated alert, he informs that the logs that matched the query were active [MGKUBERAPLH3], with quantity [14] between the time [1/13/2021, 8: 32: 57.963 PM] and [1 / 13/2021, 8: 42: 32.257 PM].
But when defining the search with the timegererated parameter with the same time that is in the [Time Frame] of the incident, that is, two retroactive hoars, it does not bring the real information to the host [MGKUBERAPLH3] of the incident, but with a new quantity number [132] and new times between the 2-hour retroactive range.
If I modify the query to insert the retroactive value of 20 minutes, as defined in the query at the time of creation, the values of the asset that was triggered in the incident are the same, being
[MGKUBERAPLH3], with the amount [14] between the time [1/13/2021, 8: 32: 57.963 PM] and [1 / 13/2021, 8: 42: 32.257 PM].
Question X is: If I set a time value in the 20 minute query and I set the schedule as 2 hours retroactive, what is taken into account?
Because the alert time frame in the incident is reported 2 hours, but the KQL results are based on 20 minutes?Luizao_f The 20 minutes is the one taken into account, and it overrides the scheduled 2-hours. If the time period that's set inline in query code is shorter than the period set in rule settings, the inline period takes precedence. If it is longer, the period set in the rule settings takes precedence.
