Chronicle API quotas
Chronicle API quotas are enforced at the server level using an interceptor. Each service that integrates with Chronicle API needs to specify the appropriate quota server key to enable quota enforcement.
The following table lists the quotas that are being enforced, where:
- QPS - Queries Per Second
- QPM - Queries Per Minute
- QPD - Queries Per Day
| Group | API | Query Quota |
|---|---|---|
| Search | ListAlerts | 1 QPS |
| Search | ListEvents | 1 QPS |
| Search | ListIocs | 1 QPS |
| Search | ListIocDetails | 1 QPS |
| Search | ListAssets | 5 QPS |
| Search | SearchRawLogs | 1 QPM |
| Partner | CreateCustomer | 10 QPD |
| Tools | RetrieveSampleLogs | 10 QPM |
| Tools | ValidateCBNParser | 1 QPS |
| Tools | ListCbnParsers | 1 QPS |
| Tools | SubmitCbnParser | 1 QPM |
| Tools | GetCbnParser | 1 QPS |
| Tools | ListCbnParserHistory | 1 QPS |
| Tools | ListCbnErrors | 1 QPS |
| Rules | GetRule | 1 QPS |
| Rules | GetDetection | 1 QPS |
| Rules | GetRetrohunt | 1 QPS |
| Rules | ListRules | 1 QPS |
| Rules | ListRuleVersions | 1 QPS |
| Rules | ListDetections | 10 QPM |
| Rules | ListRetrohunts | 1 QPS |
| Rules | CreateRule | 1 QPS |
| Rules | CreateRuleVersion | 1 QPS |
| Rules | DeleteRule | 1 QPS |
| Rules | EnableLiveRule | 1 QPS |
| Rules | DisableLiveRule | 1 QPS |
| Rules | EnableAlerting | 1 QPS |
| Rules | DisableAlerting | 1 QPS |
| Rules | RunRetrohunt | 1 QPS |
| Rules | CancelRetrohunt | 1 QPS |
| Rules | WaitRetrohunt | 1 QPS |
| Rules | StreamTestRule | 3 QPM |
| Rules | ArchiveRule | 1 QPS |
| Rules | UnarchiveRule | 1 QPS |
| Health | GetError | 1 QPS |
| Health | ListErrors | 1 QPS |
| ReferenceList | CreateReferenceList | 1 QPS |
| ReferenceList | GetReferenceList | 1 QPS |
| ReferenceList | ListReferenceLists | 1 QPS |
See additional API documentation: