A detection has two clocks | Cybernetic Intern

How late the data arrives and how often the rule runs are two separate delays. They stack, and the total is usually worse than anyone assumes.

Ask how quickly a detection fires and you usually get one number, the schedule. Every fifteen minutes, every hour, near real time.

That number is half the answer.

There are two clocks. The first is how long data takes to reach the platform: the agent buffer, the shipping interval, the API poll, whatever queue sits behind it. The second is how often the rule runs against what has arrived. They stack.

A rule scheduled hourly against a source running fifteen minutes behind can be seventy five minutes behind reality. Not sixty, and not fifteen.

Whether that matters depends entirely on what you are chasing. Seventy five minutes is fine for noticing a dormant account being re-enabled. It is useless against something that encrypts a file share in nine.

So the number only means anything next to the thing it is meant to catch. A detection slower than the attack it describes is documentation.

Take your five highest-value detections. For each, find the ingest delay on its source, add the schedule interval, and write the total next to the rule. That is your real time to detect, and for most teams it is the first time anyone has worked it out rather than assumed it.