Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Why query schedule is changed?

Copper Contributor

I used the rule template to set up the analytics in Sentinel one year ago.

For a while, queries operated every 24 hours.

I set up the rules as below.


Query scheduling

Run query every : 1 Days

Lookup data from the last : 1 Days


Then, the time when the query started operating has changed since October 13th. I haven't changed the setting of the rules at that point. I want to know in which case the operation time of the query changes.

1 Reply
When you open the 'Analytics' blade, find your rule and check the 'last modified' column, is that 13th October? Maybe someone pressed SAVE (without editing any content), if you want it to run at a certain time SAVE at that time of day i.e. 09:00.