Set the run frequency
Rule run frequency impacts the latency with which detections are discovered for each rule. Longer run frequencies increase the amount of time between when an event occurs and when a detection is processed for that event.
To specify the run frequency for a rule, complete the following steps:
Navigate to the Rules Dashboard.
Open the rule options menu.
Click Run Frequency.
Set the Run Frequency to 10 min, 1 hr, or 24 hrs. Rules with a match section with a window size greater than one hour are limited to the 1 hr and 24 hrs run frequencies.