FalconFriday — Need for Speed: going Underground with near-real-time (NRT) rules — 0xFF26

**Executive summary:** This FalconFriday research validates how Microsoft Sentinel and Defender implement near‑real‑time (NRT) analytic rules in practice, finding that look‑back windows, built‑in delays, and execution timing are flexible (not strictly fixed), that ingestion delays are handled by later query executions, and that small amounts of duplicate alerts can occur; it documents limitations (e.g., join/union use, multi‑event thresholds, ingestion‑delay compatibility, and workspace/rule limits) and provides a large KQL compatibility catalog plus guidance for converting existing detections to NRT.