SC-200 · Question #339
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You have a query that contains the following statements. You need to configure a custom detection rule that will use the…
The correct answer is B. Continuous (NRT). To minimize notification time for a custom detection rule in Microsoft Defender XDR, select the Continuous (NRT) frequency.
Question
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You have a query that contains the following statements. You need to configure a custom detection rule that will use the query. The solution must minimize how long it takes to be notified about events that match the query. Which frequency should you select for the rule?
Options
- AEvery hour
- BContinuous (NRT)
- CEvery 12 hours
- DEvery 3 hours
How the community answered
(60 responses)- A12% (7)
- B80% (48)
- C5% (3)
- D3% (2)
Why each option
To minimize notification time for a custom detection rule in Microsoft Defender XDR, select the Continuous (NRT) frequency.
"Every hour" is a less frequent option than continuous (NRT) and would introduce significant delays in notification compared to near real-time.
The "Continuous (NRT)" (Near Real-time) frequency setting for custom detection rules in Microsoft Defender XDR ensures the fastest possible processing of events, leading to the quickest notification when a query match is found.
"Every 12 hours" is a much less frequent option, which would result in substantial delays for notifications, failing to minimize the time to be notified.
"Every 3 hours" is a less frequent option compared to continuous (NRT) and would not achieve the goal of minimizing notification time.
Concept tested: Microsoft Defender XDR custom detection rule frequency
Source: learn.microsoft.com/microsoft-365/security/defender-endpoint/custom-detection-rules
Community Discussion
No community discussion yet for this question.