Azure Sentinel, Analytics Rule 14 days lookback limit

897 Views Asked by At

When writing log analytics rule it has an option for a lookback time period which is 14 days maximum. However, I am writing queries/rules that are correlating historical data for last 30 days and because of this limit, I am missing some potential matches.

Is there a way to increase the 14-day lookback limit or workarounds to solve this issue?

0

There are 0 best solutions below