The query filters on ingestion_time() > ago(1d) , which means it is interested in recently ingested device telemetry (DeviceEvents and DeviceProcessEvents) within the last 24 hours. To minimize the time between an event ingest and a detection/notification, you want the rule engine to evaluate the query as close to real- time as possible. Microsoft's XDR/Defender detection framework supports continuous (near-real-time, NRT) detection mode, which evaluates incoming telemetry continuously (or at very short intervals) rather than waiting for a scheduled run.
Scheduled analytics/detection rules run on fixed intervals (for example every hour, every 3 hours, etc.), which introduces a guaranteed latency equal to the schedule period. By contrast, a Continuous (NRT) rule processes telemetry as it arrives (or in very short batch windows), dramatically reducing the time-to-alert for matching events. That makes Continuous (NRT) the correct choice when the requirement is to minimize notification latency for device events.
Note the operational trade-offs: continuous rules can generate more frequent evaluations and higher operational overhead (and potentially more noise), so they should be scoped and tuned appropriately (filters, distinct counts, thresholds) to avoid excessive alerts.