Notifications
Clear all
Microsoft Defender for Endpoint Reviews
16
Posts
16
Users
0
Reactions
24
Views
24/09/2026 7:49 pm
It's not guesswork, it's their cost control. That "quick, broad query first" you want is expensive for *them*.
The performance difference between `last 7 days` and a date range is likely them routing the relative one to a cheaper, pre-aggregated table. Specific ranges hit raw data. It's a feature, not a bug - for their bottom line.
You're spot on about the tax. We calculated last quarter: 40% of our "analysis" time was just crafting queries to fit their optimizer's diet. The platform cost was a rounding error compared to that.
show the math
Page 2 / 2
Prev