Explanation:

When creating scheduled analytics rules in Microsoft Sentinel, you should account for ingestion delay so late-arriving events aren't missed, while also avoiding reprocessing the same events. The recommended pattern is to widen the TimeGenerated window by the expected delay and then gate results by ingestion_time() to include only data that actually arrived within the delay window:
let ingestion_delay = 5min;
let rule_look_back = 7min;
CommonSecurityLog
| where TimeGenerated >= ago(ingestion_delay + rule_look_back) // cover late arrivals
| where ingestion_time() > ago(ingestion_delay) // only newly ingested data
* TimeGenerated >= ago(ingestion_delay + rule_look_back) ensures the query looks back 7 + 5 = 12 minutes, so events that were generated up to 7 minutes ago but arrived up to 5 minutes late are still captured.
* ingestion_time() > ago(ingestion_delay) limits results to items ingested in the last 5 minutes, preventing the same already-processed events from being picked up again on the next run, while minimizing misses due to late ingestion.
Thus, choose (ingestion_delay + rule_look_back) for the first blank and (ingestion_delay) for the second.