Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 14 subscribers
  • Views 1264 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How often do servers/endpoints upload to the data lake?

an_enterprise_user

There appears to be a delay between when an event happens on a server or endpoint and when I can run a live discover query on that data in the data lake. How long does it take for the Sophos agent to synchronize or upload it's data to the data lake?



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Each different element in the query pack has its own schedule. They are bundled together and uploaded at a regular interval - I will double check the exact interval.

    However, there is also a local daily limit to the total amount of data an endpoint can upload - if it exceeds that limit it will throttle and not send anything further until the next day.

Reply
  • FormerMember
    0 FormerMember

    Each different element in the query pack has its own schedule. They are bundled together and uploaded at a regular interval - I will double check the exact interval.

    However, there is also a local daily limit to the total amount of data an endpoint can upload - if it exceeds that limit it will throttle and not send anything further until the next day.

Children
No Data
Unfiltered HTML