Skip to content

Commit a648451

Browse files
Merge pull request #302001 from guywi-ms/analytics-rule-limits
Update sentinel-service-limits.md
2 parents 192b448 + 1d38080 commit a648451

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

articles/sentinel/sentinel-service-limits.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ The following limit applies to analytics rules in Microsoft Sentinel.
2222

2323
| Description | Limit | Dependency |
2424
| ----------- | ----- | ---------- |
25-
| Number of [scheduled rules](scheduled-rules-overview.md) | 512 *enabled* rules | Counted separately from NRT rules |
26-
| Number of [near-real-time (NRT) rules](near-real-time-rules.md) | 50 *enabled* rules | Counted separately from scheduled rules |
25+
| Number of [scheduled rules](scheduled-rules-overview.md) | 512 *enabled* rules, 1024 in total, including disabled rules.<br>With a [dedicated cluster](/azure/azure-monitor/logs/logs-dedicated-clusters) - 1024 *enabled* rules, 2048 in total, including disabled rules. Requires a request to increase the default limit through a [support ticket](/azure/azure-portal/supportability/how-to-create-azure-support-request). | Counted separately from NRT rules |
26+
| Number of [near-real-time (NRT) rules](near-real-time-rules.md) | 50 *enabled* rules, 100 in total, including disabled rules | Counted separately from scheduled rules |
2727
| [Entity mappings](map-data-fields-to-entities.md) | 10 mappings per rule | None |
2828
| [Entities](map-data-fields-to-entities.md) identified per alert<br>(Divided equally among the mapped entities) | 500 entities per alert | None |
2929
| [Entities](map-data-fields-to-entities.md) cumulative size limit | 64 KB | None |

0 commit comments

Comments
 (0)