Customizable schedules for multi-event rules

Customizable schedules for multi-event rules

Customizable schedules for multi-event rules are available in public preview. You can customize rule execution schedules on the Rule schedule tab to specify a first-run delay offset that accounts for data ingestion latency. The system also performs automated background true-up runs to catch late-arriving logs and process metadata enrichment without requiring manual system interventions. This gives you precise control over detection evaluation timing, reduces false negatives without missing detections, and promotes alert accuracy.

To view or modify rule schedules using custom Identity and Access Management (IAM) roles, update your IAM permissions to include the following:

• chronicle.ruleDeployments.update to update individual rule schedules using the API. • chronicle.rules.modifyRules to modify rule schedules using the web interface or in batch using the API.

If you use predefined IAM roles, such as Chronicle API Admin (roles/chronicle.admin) or Chronicle API Editor (roles/chronicle.editor), these permissions are included automatically.