Skip to content

Commit 3a361a2

Browse files
Merge pull request #304304 from poliveria/poliveria-corrections
Poliveria corrections
2 parents 4e8082e + 715633e commit 3a361a2

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

articles/sentinel/understand-threat-intelligence.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ titleSuffix: Microsoft Sentinel
44
description: Understand threat intelligence and how it integrates with features in Microsoft Sentinel to analyze data, detect threats, and enrich alerts.
55
author: guywi-ms
66
ms.topic: concept-article
7-
ms.date: 02/27/2025
7+
ms.date: 08/18/2025
88
ms.author: guywild
99
ms.reviewer: alsheheb
1010
appliesto:
@@ -222,7 +222,7 @@ View your threat intelligence from the management interface or using queries:
222222
223223
### Threat intelligence lifecycle
224224

225-
Microsoft Sentinel stores threat intelligence data in your threat intelligence tables and automatically reingests all data every seven days to optimize query efficiency.
225+
Microsoft Sentinel stores threat intelligence data in your threat intelligence tables and automatically reingests all data every seven to 10 days to optimize query efficiency.
226226

227227
When an indicator is created, updated, or deleted, Microsoft Sentinel creates a new entry in the tables. Only the most current indicator appears on the management interface. Microsoft Sentinel deduplicates indicators based on the `Id` property (the `IndicatorId` property in the legacy `ThreatIntelligenceIndicator`) and chooses the indicator with the newest `TimeGenerated[UTC]`.
228228

articles/sentinel/use-threat-indicators-in-analytics-rules.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ According to the default settings, each time the rule runs on its schedule, any
7777
In Microsoft Sentinel, the alerts generated from analytics rules also generate security incidents. On the Microsoft Sentinel menu, under **Threat Management**, select **Incidents**. Incidents are what your security operations teams triage and investigate to determine the appropriate response actions. For more information, see [Tutorial: Investigate incidents with Microsoft Sentinel](./investigate-cases.md).
7878

7979
> [!NOTE]
80-
> Because analytic rules constrain lookups beyond 14 days, Microsoft Sentinel refreshes indicators every 12 days to make sure they're available for matching purposes through the analytic rules.
80+
> Because analytic rules constrain lookups beyond 14 days, Microsoft Sentinel refreshes indicators every seven to 10 days to make sure they're available for matching purposes through the analytic rules.
8181
8282
## Related content
8383

0 commit comments

Comments
 (0)