Nov 07 2021 06:41 PM
I used the rule template to set up the analytics in Sentinel one year ago.
For a while, queries operated every 24 hours.
I set up the rules as below.
Query scheduling
Run query every : 1 Days
Lookup data from the last : 1 Days
Then, the time when the query started operating has changed since October 13th. I haven't changed the setting of the rules at that point. I want to know in which case the operation time of the query changes.
Nov 08 2021 01:45 AM