Indicator of Attack Detection Delays

Tenable Identity Exposure automatically adjusts the analysis window when it detects lost or delayed events—such as those caused by long GZ file replication times or a high volume of generated data.

While it typically analyzes data in 5-minute windows, it can extend the window up to one hour to account for late-arriving events. This adjustment may delay attack detection by up to one hour after the attack occurs.