What is leading? Query scheduling? Or the lookback in the query?

Good night, GaryBushey 

Maybe you can help me.

I am having some information conflicts in this regard.

In the incident [52080], the first alert generated informs that the search frame is in 2 hours retroactive, as it was configured in the rule in 2 hours retroactive.

In the query, a 20-minute retroactive team was defined.

When entering the event log, when going to Time Range, the 2-hour retroactive time is configured, as configured in the rule, being the same value found in [Time Frame] when the incident was generated. So far, everything as expected.

From here the confusion begins with information.

Upon entering the logs of the generated alert, he informs that the logs that matched the query were active [MGKUBERAPLH3], with quantity [14] between the time [1/13/2021, 8: 32: 57.963 PM] and [1 / 13/2021, 8: 42: 32.257 PM].

But when defining the search with the timegererated parameter with the same time that is in the [Time Frame] of the incident, that is, two retroactive hoars, it does not bring the real information to the host [MGKUBERAPLH3] of the incident, but with a new quantity number [132] and new times between the 2-hour retroactive range.

If I modify the query to insert the retroactive value of 20 minutes, as defined in the query at the time of creation, the values ​​of the asset that was triggered in the incident are the same, being
[MGKUBERAPLH3], with the amount [14] between the time [1/13/2021, 8: 32: 57.963 PM] and [1 / 13/2021, 8: 42: 32.257 PM].

Question X is: If I set a time value in the 20 minute query and I set the schedule as 2 hours retroactive, what is taken into account?
Because the alert time frame in the incident is reported 2 hours, but the KQL results are based on 20 minutes?