LimaCharlie Sensors (EDRs and other data sources) is processed in real-time in LimaCharlie, but the Timeline view and Detections view (and associated APIs) used to be guaranteed up to date within approximately 3 minutes.
This has now changed. When you hit an API (or through the web-app) to get data from a specific sensor (like viewing the Timeline or Detections for a specific sensor), you will now get data fresh closer to ~5s.
Note that this is for specific sensors, hitting the Detections view for all sensors, or hitting LCQL will still result in the old freshness guarantees.
This is now possible because hitting those APIs forces a flush of the in-flight sensor data to our storage layer. So hitting the API means up to date data for that sensor will now be queryable.
The expected main beneficiary of this is AI. No news to anyone, AIs are doing attacks now, we need to make sure that if a detection occurs on a given sensor, an AI can immediately spin up and investigate it and all the up to date context we have on that sensor.
Happy hunting.