Microsoft Defender XDR, Create and manage custom detections rules
Rule frequency
When you save a new rule, it runs and checks for matches from the past 30 days of data. The rule then runs again at fixed intervals, applying a lookback period based on the frequency you choose:
Every 24 hours - Runs every 24 hours, checking data from the past 30 days.
Every 12 hours - Runs every 12 hours, checking data from the past 48 hours.
Every 3 hours - Runs every 3 hours, checking data from the past 12 hours.
Every hour - Runs hourly, checking data from the past 4 hours.
Continuous (NRT) - Runs continuously, checking data from events as they're collected and processed in near real-time (NRT), see Continuous (NRT) frequency.
Reference:
https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules