How long does it take for log events to appear in Panther's data lake?
QUESTION
After a log event is successfully ingested into Panther, how long does it normally take for me to be able to query the event in the data lake?
ANSWER
We aim to have data queryable within 2-3 minutes of ingestion, but under some circumstances, higher latencies can be observed. In general, you should allow at least 15 minutes after an event ingestionbefore querying, to avoid any issues with latency.