Setting a custom detection rule frequency to identify C2 communication within the past 14 days

SC-200 By islever Editorial Last updated

Configure detections

Short answer

B Every 24 hours uses a 30-day lookback, so every run covers the full 14-day window the rule must identify.

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. The security team at your company detects command and control (C2) agent traffic on the network. Agents communicate once every 50 hours. You need to create a Microsoft Defender XDR custom detection rule that will identify compromised devices and establish a pattern of communication. The solution must meet the following requirements: • Identify all the devices that have communicated during the past 14 days. • Minimize how long it takes to identify the devices. To what should you set the detection frequency for the rule?
  1. Every 12 hours
  2. Every 24 hours Correct Answer
  3. Every three hours
  4. Every hour

Key Takeaways

Each custom detection rule frequency pairs with a fixed lookback: Every 24 hours checks the past 30 days, so it satisfies the 14-day historical identification in a single run, whereas shorter frequencies have much smaller lookback windows.

A custom detection rule must identify devices that communicated in the past 14 days and minimize identification delay; the Every 24 hours frequency uses a 30-day lookback, so every run covers the full 14-day window while keeping a simple daily cadence.

Common mistake: Choosing Every hour to 'minimize time' — its lookback is only a few hours, so it does not cleanly cover the 14-day historical window each run the way the 30-day lookback of the 24-hour frequency does.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender XDR custom detection rules map each frequency to a lookback duration: Every 24 hours runs daily and checks data from the past 30 days. That 30-day lookback satisfies the requirement to identify all devices that communicated during the past 14 days on every run, and a daily cadence is sufficient given the agents beacon only once every 50 hours.

Why the Other Options Are Wrong

Every 12 hours (A) checks only the past 48 hours per run, so it does not cover the full 14-day window each run. Every 3 hours (C) and Every hour (D) have even smaller lookback windows (around 12 hours and 4 hours respectively), which fragment the 14-day coverage and add unnecessary run overhead without improving the 50-hour beacon detection.

Community Comment Notes

The community is split (B 56, A 28, D 17). talosDevbot, smosmo, and sapphire cite https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#rule-frequency, confirming the 24-hour frequency's 30-day lookback. The deciding factor is that the 30-day lookback cleanly satisfies the 14-day historical identification requirement on every run.

Official Reference

https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules

This link opens the official vendor documentation in a new tab.

Community Votes

B
55%
A
28%
D
17%

55% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Sekpluz 👍 5 Answered A
    I believe Option A is the correct answer. Here’s why: Once you create and run the rule for the first time, it will, by default, check for the last 30 days. This means we can already scan the past 14 days as stated in the question. Now, if we choose Option A, which is a 12-hour interval, it checks every 12 hours and scans back 48 hours. This is less than the 50 hours of the Command and Control (C&C), making it the most balanced option. Therefore, I would choose Option A. https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules
  2. smosmo 👍 4
    Rule frequency When you save a new rule, it runs and checks for matches from the past 30 days of data. The rule then runs again at fixed intervals, applying a lookback duration based on the frequency you choose: Every 24 hours—runs every 24 hours, checking data from the past 30 days Every 12 hours—runs every 12 hours, checking data from the past 48 hours Every 3 hours—runs every 3 hours, checking data from the past 12 hours Every hour—runs hourly, checking data from the past 4 hours Continuous (NRT)—runs continuously, checking data from events as they're collected and processed in near real-time (NRT), see Continuous (NRT) frequency
  3. talosDevbot 👍 4 Answered B
    Every 24 hours — runs every 24 hours, checking data from the past 30 days "Match the time filters in your query with the lookback duration. Results outside of the lookback duration are ignored."
  4. g_man_rap 👍 3 Answered B
    Communication Frequency of C2 Agents: The C2 agents communicate once every 50 hours. To effectively catch this communication pattern within the past 14 days, running the detection rule every 24 hours would be sufficient. This frequency allows you to regularly scan for the C2 traffic while balancing the resource usage and performance of your detection system.
  5. Optimizor_IT 👍 2 Answered D
    Set detection frequency to “Every hour” in the custom detection rule wizard (Step 2: Rule settings > Frequency). Lookback period = 14 days ensures all devices from the past 14 days are identified. 1-hour frequency minimizes identification time (max delay = 1 hour vs. 50-hour C2 cycle), meeting the “minimize how long” requirement. Why Not Others? A (12 hours): 12-hour delay—too slow for timely C2 response. B (24 hours): 24-hour delay—misses half a day, risking escalation. C (3 hours): 3-hour delay—better, but still triples the wait vs. hourly.
Show 4 more comments
  1. sapphire 👍 2 Answered B
    B is correct answer https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#rule-frequency
  2. Edindude 👍 1 Answered B
    Using a 24-hour detection frequency would certainly work, but it might not be the most efficient choice for your scenario. Here’s why: Communication Pattern: Since the agents communicate once every 50 hours, setting the detection frequency to 24 hours may result in delayed identification of the compromised devices. There's a chance you might miss an entire communication window and only catch it on the next cycle, effectively identifying devices every 72 hours. Balance Between Timeliness and Efficiency: A 12-hour frequency strikes a better balance. It ensures that you have more frequent checks without significantly increasing the load on your system. This means that even if you miss one communication window, you're likely to catch it on the next 12-hour cycle, improving your chances of timely detection. Choosing a 12-hour frequency helps ensure more timely detection and a better understanding of the communication pattern while maintaining efficiency. If you have any more questions or need further assistance, feel free to ask!
  3. dejo 👍 1 Answered D
    Don't have experience with CDR but I think about it this way: Hourly runs: Detects C2 communication at ~51 hours, looking back only 4 hours (fastest results) 3-hour runs: Also detects at ~51 hours but processes 12 hours of data (slower) 12-hour runs: Detects at 60 hours, checking 48 hours of data (slower results) 24-hour runs: Detects at 72 hours, checking 30 days of data (longest delay) The first time the rule is run, it will automatically cover the last 30 days, allowing us to examine the 14-day period as outlined in the question (requirement: Identify all the devices that have communicated during the past 14 days.)
  4. 12369b6 👍 1
    B - every 24 hours You need to identify devices that have communicated during the past 14 days, and the agents communicate every 50 hours. Setting the detection frequency to every 24 hours ensures that you capture all relevant communications within a reasonable time frame while minimizing performance impact.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide