liveBook · Manning

Near-real-time rule

As explained in Azure Security

A Microsoft Sentinel detection rule that runs at approximately one-minute intervals to provide more current detection results.

A near-real-time (NRT) rule in Microsoft Sentinel runs a detection query every minute, shortening the delay between collected data and security results. It provides a faster alternative when scheduled query rules cannot meet a five-minute minimum interval. section 8.4.4

Configure the rule with these operational considerations:

  • Use NRT rules when ingestion-lag-aware scheduled execution is not fast enough. section 8.4.4
  • Treat the feature as preview functionality and review its documented limitations before deployment. section 8.4.4
  • Apply the same detection use cases and incident configuration principles used with scheduled rules. section 8.4.4

Failed-login detection

A failed-login query can summarize Event ID 4625 events by account and computer, then support a faster detection cycle when configured as an NRT rule. section 8.4.4

How Azure Security covers it

How deep it goes
Explains execution frequency, scheduled-rule comparison, preview status, and limitations without detailing implementation steps.
Examples
Uses failed-login events identified by Event ID 4625 as a concrete detection scenario.
What it assumes
Assumes a completed detection query and awareness that scheduled rules account for ingestion lag through a five-minute minimum.
What you can do after
Apply it via Microsoft Sentinel to obtain more current detection results for supported security use cases.
How it connects
Connects NRT rules with scheduled query rules, ingestion lag, alert thresholds, incidents, alert grouping, automation rules, and playbooks.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.