The scalability of the framework is constantly improved and tested to allow more traffic with less infrastructure. These are the current data loads officially supported by Google Security Operations (average results collected during a 10 minute test):
Prerequisites
Connector \ Action Execution Time (avg): 7-10 seconds Connector \ Action Result Size (avg): 500KB – 1MB Request: An end-to-end flow of sending a request to the agent and getting the response back into Google SecOps. A single request equals a single action execution or a single connector run.
Basic Agent (4 cores, 8GB RAM, 100GB Storage)
Actions Rate: 96 actions\minute Connectors Rate: 96 runs\minute (e.g. 16 connectors, each connector runs every 10 seconds, each brings back a result) Combined Rate: 96 requests\minute (e.g. 60 Actions + 6 Connectors, each connector runs every 10 seconds, each brings back a result)
Scaled Up Agent (8 cores, 16GB RAM, 100GB Storage)
Actions Rate: 144 actions\minute (completed full run) Connectors Rate: 144 runs\minute (e.g. 24 connectors, each connector runs every 10 seconds, each brings back a result) Combined Rate: 144 requests\minute (e.g. 90 Actions + 9 Connectors, each connector runs every 10 seconds, each brings back a result)
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-03-06 UTC."],[[["Google SecOps supports a remote agent scaling strategy, continuously improving and testing its framework to handle increased traffic with less infrastructure."],["The basic agent configuration, with 4 cores and 8GB RAM, can process 96 actions, connector runs, or combined requests per minute."],["A scaled-up agent with 8 cores and 16GB RAM supports higher rates, processing up to 144 actions, connector runs, or combined requests each minute."],["Each connector action execution takes approximately 7-10 seconds, returning a result size averaging between 500KB and 1MB."],["A single request, whether an action execution or connector run, represents a single interaction where data is sent to the agent and a response is received in Google SecOps."]]],[]]
