{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/", "slug": "dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency", "url": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/" }, "title": "Do not read an Application Map filter percentile as request latency", "summary": "Does P90 beside an Application Map average-duration filter describe the slowest tenth of individual requests?", "format": { "slug": "explainer", "name": "Explainer" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:33+00:00", "modified_at": "2026-09-10T01:20:45+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 238, "potentially_affected": "Azure Monitor Application Map connector filters for distributed applications.", "dse_recommendation": "State that the filter ranks connector averages, then inspect request evidence before making a latency conclusion.", "primary_source": { "name": "Application map in Azure Application Insights - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-map", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Application Map’s average-duration connector filter measures the mean duration of calls across each connector. A P90 label on a suggested filter value describes the distribution of connectors, irrespective of how many calls each represents. Microsoft’s 200-millisecond example means that 90 percent of connectors have an average duration below that value, not that 90 percent of all requests completed within it. Microsoft Learn.

\n

Map filters also apply in sequence from left to right. Once an earlier filter removes a node or connector, a later filter cannot bring it back. Microsoft Learn.

\n

Applicability

\n

Review Azure Monitor Application Map connector filters for distributed applications. Keep the map-selection statistic separate from a request-level latency objective or an application’s end-to-end response time.

\n

DSE recommendation

\n

DSE recommends labeling a saved investigation view with the connector statistic being selected. Compare low-volume and high-volume connectors before treating the percentile label as a workload-wide result. Use the filtered map to choose where to investigate, then examine the relevant request and dependency evidence. Preserve the filter order so another operator can reproduce why a connection was visible or absent.

\n

Verification

\n

Choose two connectors with different call volumes and compare their displayed averages with the selected filter boundary. Review the underlying calls for the actual latency question. Remove filters in a controlled comparison to identify excluded paths. Do not report a request percentile merely by copying the P90 label from a map filter.

\n

Official references

\n

Microsoft Learn: Application Map.

", "content_text": "Source facts\nApplication Map’s average-duration connector filter measures the mean duration of calls across each connector. A P90 label on a suggested filter value describes the distribution of connectors, irrespective of how many calls each represents. Microsoft’s 200-millisecond example means that 90 percent of connectors have an average duration below that value, not that 90 percent of all requests completed within it. Microsoft Learn.\nMap filters also apply in sequence from left to right. Once an earlier filter removes a node or connector, a later filter cannot bring it back. Microsoft Learn.\nApplicability\nReview Azure Monitor Application Map connector filters for distributed applications. Keep the map-selection statistic separate from a request-level latency objective or an application’s end-to-end response time.\nDSE recommendation\nDSE recommends labeling a saved investigation view with the connector statistic being selected. Compare low-volume and high-volume connectors before treating the percentile label as a workload-wide result. Use the filtered map to choose where to investigate, then examine the relevant request and dependency evidence. Preserve the filter order so another operator can reproduce why a connection was visible or absent.\nVerification\nChoose two connectors with different call volumes and compare their displayed averages with the selected filter boundary. Review the underlying calls for the actual latency question. Remove filters in a controlled comparison to identify excluded paths. Do not report a request percentile merely by copying the P90 label from a map filter.\nOfficial references\nMicrosoft Learn: Application Map.", "content_markdown": "## Source facts\n\nApplication Map’s average-duration connector filter measures the mean duration of calls across each connector. A P90 label on a suggested filter value describes the distribution of connectors, irrespective of how many calls each represents. Microsoft’s 200-millisecond example means that 90 percent of connectors have an average duration below that value, not that 90 percent of all requests completed within it. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-map).\n\nMap filters also apply in sequence from left to right. Once an earlier filter removes a node or connector, a later filter cannot bring it back. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-map).\n\n## Applicability\n\nReview Azure Monitor Application Map connector filters for distributed applications. Keep the map-selection statistic separate from a request-level latency objective or an application’s end-to-end response time.\n\n## DSE recommendation\n\nDSE recommends labeling a saved investigation view with the connector statistic being selected. Compare low-volume and high-volume connectors before treating the percentile label as a workload-wide result. Use the filtered map to choose where to investigate, then examine the relevant request and dependency evidence. Preserve the filter order so another operator can reproduce why a connection was visible or absent.\n\n## Verification\n\nChoose two connectors with different call volumes and compare their displayed averages with the selected filter boundary. Review the underlying calls for the actual latency question. Remove filters in a controlled comparison to identify excluded paths. Do not report a request percentile merely by copying the P90 label from a map filter.\n\n## Official references\n\n[Microsoft Learn: Application Map](https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-map)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/", "url": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not read an Application Map filter percentile as request latency", "item": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/", "url": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/", "headline": "Do not read an Application Map filter percentile as request latency", "description": "Does P90 beside an Application Map average-duration filter describe the slowest tenth of individual requests?", "abstract": "Does P90 beside an Application Map average-duration filter describe the slowest tenth of individual requests?", "articleBody": "Source facts\nApplication Map’s average-duration connector filter measures the mean duration of calls across each connector. A P90 label on a suggested filter value describes the distribution of connectors, irrespective of how many calls each represents. Microsoft’s 200-millisecond example means that 90 percent of connectors have an average duration below that value, not that 90 percent of all requests completed within it. Microsoft Learn.\nMap filters also apply in sequence from left to right. Once an earlier filter removes a node or connector, a later filter cannot bring it back. Microsoft Learn.\nApplicability\nReview Azure Monitor Application Map connector filters for distributed applications. Keep the map-selection statistic separate from a request-level latency objective or an application’s end-to-end response time.\nDSE recommendation\nDSE recommends labeling a saved investigation view with the connector statistic being selected. Compare low-volume and high-volume connectors before treating the percentile label as a workload-wide result. Use the filtered map to choose where to investigate, then examine the relevant request and dependency evidence. Preserve the filter order so another operator can reproduce why a connection was visible or absent.\nVerification\nChoose two connectors with different call volumes and compare their displayed averages with the selected filter boundary. Review the underlying calls for the actual latency question. Remove filters in a controlled comparison to identify excluded paths. Do not report a request percentile merely by copying the P90 label from a map filter.\nOfficial references\nMicrosoft Learn: Application Map.", "datePublished": "2026-09-10T00:28:33+00:00", "dateModified": "2026-09-10T01:20:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-203-do-not-read-an-application-map-filter-percentile-as-request-latency/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not read an Application Map filter percentile as request latency" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Explainer", "Information priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 238, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Application map in Azure Application Insights - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-map" } } ] } }