Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarity on TimeGenerated, snapshot ingestion #8392

Merged
merged 1 commit into from Oct 5, 2020
Merged

Clarity on TimeGenerated, snapshot ingestion #8392

merged 1 commit into from Oct 5, 2020

Conversation

cinglis-msft
Copy link
Contributor

@o0nj
Copy link
Contributor

o0nj commented Oct 3, 2020

@JohanFreelancer9 Copy editing is needed for this PR. Thanks.


Update Compliance is refreshed every 12 hours. This means that every 12 hours all data that has been gathered over the last 12-hour interval is pushed to Log Analytics. However, the rate at which each type of data is sent from the device and how long it takes to be ready for Update Compliance varies, roughly outlined below.
The data powering Update Compliance is refreshed every 24 hours, and refreshes with the latest data from all devices part of your organization that have been seen in the past 28 days. The entire set of data is refreshed in each daily snapshot, which means that the same data can be re-ingested even if no new data actually arrived from the device since the last snapshot. Snapshot time can be determined by the TimeGenerated field for each record, while LastScan can be used to roughly determine the freshness of each record's data.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The data powering Update Compliance is refreshed every 24 hours, and refreshes with the latest data from all devices part of your organization that have been seen in the past 28 days. The entire set of data is refreshed in each daily snapshot, which means that the same data can be re-ingested even if no new data actually arrived from the device since the last snapshot. Snapshot time can be determined by the TimeGenerated field for each record, while LastScan can be used to roughly determine the freshness of each record's data.
The data powering Update Compliance is refreshed every 24 hours, and refreshes with the latest data from all devices in your organization that have been seen in the past 28 days. The entire set of data is refreshed in each daily snapshot, which means that the same data can be re-ingested even if no new data actually arrived from the device since the last snapshot. Snapshot time can be determined by the TimeGenerated field for each record, while LastScan can be used to roughly determine the freshness of each record's data.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion only.

Copy link
Contributor

@JohanFreelancer9 JohanFreelancer9 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy review.

@jaimeo
Copy link
Contributor

jaimeo commented Oct 5, 2020

I'm not a huge fan of "ingestion," which feels a little disgustingly biological to me, but TermStudio says it's copacetic.

@jaimeo jaimeo merged commit 8982f62 into MicrosoftDocs:public Oct 5, 2020
learn-build-service-prod bot pushed a commit that referenced this pull request Jun 14, 2023
Add ARM deny rules for vulnerable HVCIScan
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
6 participants