Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Namespace: microsoft.graph.security
Important
APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Represents how often the custom detection rule runs, how far back each run reads events, and when it next runs. The schedule property of a detectionRule uses this resource type.
Properties
| Property | Type | Description |
|---|---|---|
| frequency | Duration | The recurring time interval at which the rule runs (ISO 8601 duration, for example P1D for daily, PT1H for hourly). |
| lookback | Duration | The time window evaluated by each scheduled rule run, expressed as an ISO 8601 duration, for example PT4H for four hours. Events match this window based on either event time or ingestion time. The value must be at least frequency. When omitted, the service derives the default lookback from frequency. Not supported for near-real-time rules with a zero frequency. |
| nextRunDateTime (deprecated) | DateTimeOffset | Timestamp of the custom detection rule's next scheduled run. Deprecated. This property will be removed from this resource on 2026-10-01. |
| period (deprecated) | String | How often the detection rule is set to run. The allowed values are: 0, 1H, 3H, 12H, or 24H. 0 signifies the rule is run continuously. Deprecated. Use frequency instead. This property will be removed from this resource on 2026-10-01. |
Relationships
None.
JSON representation
The following JSON representation shows the resource type.
{
"@odata.type": "#microsoft.graph.security.ruleSchedule",
"frequency": "String (duration)",
"lookback": "String (duration)",
"nextRunDateTime": "String (timestamp)",
"period": "String"
}