Insider risk management configuration (scan process duration)

Hi all, 

Does anyone know how long it takes to scan for potential insider risks? The guidelines talk that it can take up to 24 hours to detect and return any risk activity, but in my case, it runs continuously for 48 hours and has not yet been completed.

Thanks in advance