FalconFriday — Need for Speed: going Underground with near-real-time (NRT) rules — 0xFF26

FalconFriday researchers evaluate Microsoft Sentinel and Defender near-real-time (NRT) analytic rules, empirically testing look-back periods, built-in delays, ingestion delay handling, duplicate alerts, and KQL syntax limitations. The post contrasts Sentinel’s time-window based NRT behavior with Defender’s batch-based processing, documents practical limitations (joins/unions, multi-event thresholds, rule limits), and outlines a methodology and conversion guidance for making custom detection rules NRT-compatible.