Rate Limits on Event Search

XDR employs rate limiting on events search to ensure consistent and optimum performance. This is an essential step to prevent the application from being overwhelmed by more requests than it can handle gracefully. Two kinds of rate limiting are employed:

• Concurrent Running Request Quotas —Restricts the number of queries that can simultaneously execute per tenant. Presently, a maximum of 10 concurrent requests are allowed for each tenant.
• Data Scan Limits —Manages the volume of data scanned during any query. Queries to the search database are restricted to a maximum scan limit of 10TB.

Rate limits help ensure a balanced distribution of resources to all users. If you often hit these limits and require a higher quota, please contact our support team so that we can review the situation with you and better understand your needs.