This table serves as a handy checklist for cyber analysts when creating KQL analytic rules. It provides a clear comparison between Near Real-Time (NRT) and Regular Analytic rules, highlighting key considerations such as query interval, ingestion delay, alert generation, event grouping, rule creation, and limitations. By referring to this table, analysts can make an informed decision on whether to use an NRT or a Regular Analytic rule based on their specific needs and constraints. This can help streamline the rule creation process and ensure effective and efficient threat detection. Remember, the choice between NRT and Regular Analytic rules ultimately depends on the specific requirements of your security operations center.
Link: KQL/NRTchecklist. at main · guys1444/KQL (github.com)
