Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

What's the interval of reporting data collected on clients to cloud for EDR sensor?

Copper Contributor

Hi,

 

Defender EDR collects data from client, such as process creation, network connection, user logon. How much time does it take for these data to be stored in Threat hunting tables?

Is there a setting that can be used to change the frequency?

 

Thanks.

3 Replies

@NathanZ0202 

You can find "Expedite telemetry reporting frequency" options in intune and configmgr.

mas18_0-1645969518281.png

In MDE portal, Endpoint - Timeline section will have almost real-time telemetry data that can also be used for investigation. I don't think there is specific option for reporting frequency for threat hunting. Sometime(I experienced) It may took around 8 hours to have updated data in MDE tenant.

Thank you.
I also experienced a latency of 30 minutes to get a command line record. Just wondering it is unacceptable if I get data so late.