Maximum number of minutes to use for DedupPeriodMinutes in a Panther detection

QUESTION

Is there a maximum number of minutes to use in the field DedupPeriodMinutes when creating a detection?

ANSWER

The detection editor in the Panther Console supports a maximum deduplication period of 24 hours. If you upload your detections via the bulk uploader or the Panther Analysis Tool (PAT), there is no limit on the value of DedupPeriodMinutes You can learn more about deduplication configuration in our documentation here.