+3Hello, team
I’d like to understand the delay between when a case is created and when it’s detected. All cases based on CrowdStrike have a delay of 1 to 2 hours before the alert is generated.
Can this time be adjusted? Why does this only happen with CrowdStrike?
We have two SecOps consoles with different environments, and this delay only occurs on one of them; both have the same collection permissions.
+18What you have shared here is saying that your event time happens after your rule triggers.
event timestamp is 20:17:56
detect timestamp is 17:18:00
This is impossible. Are your tools setup all in the same time zones?
+18Also to note, this rule by default runs every hour. You would need to make a copy of this rule and make it custom if you wanted it to br near real time or every 10 mins.
+14Hi
The below documentation may be of use:
Understand rule detection delays | Google Security Operations | Google Cloud Documentation
In particular, this will allow you to help analyze where the latency may be:
https://docs.cloud.google.com/chronicle/docs/detection/detection-delays#analyze-delays
Kind Regards,
Ayman
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
