Skip to content

Commit 9cef79b

Browse files
authored
Update near-real-time-rules.md
1 parent 0b4acc5 commit 9cef79b

File tree

1 file changed

+0
-2
lines changed

1 file changed

+0
-2
lines changed

articles/sentinel/near-real-time-rules.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,6 @@ The following limitations currently govern the use of NRT rules:
4141

4242
1. The query defined in an NRT rule can reference **only one table**. Queries can, however, refer to multiple watchlists.
4343

44-
1. You cannot use unions or joins.
45-
4644
1. Because this rule type is in near real time, we have reduced the built-in delay to a minimum (two minutes).
4745

4846
1. Since NRT rules use the ingestion time rather than the event generation time (represented by the TimeGenerated field), you can safely ignore the data source delay and the ingestion time latency (see above).

0 commit comments

Comments
 (0)