A hunting query will become a Defender XDR custom detection. What must its output and scheduling satisfy?

1. A random id unrelated to the source events
2. Remove all timestamps
3. The supported detection schema, entity and event identifiers, and rule requirements
4. Only that its text is syntactically short