Skip to content

Commit c610cd9

Browse files
authored
Fixed correction advice
1 parent ac9ccbb commit c610cd9

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

articles/sentinel/includes/sentinel-limits-incidents.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: "include file"
44
services: microsoft-sentinel
55
author: cwatson-cat
66
ms.topic: "include"
7-
ms.date: 12/01/2022
7+
ms.date: 27/05/2024
88
ms.author: cwatson
99
ms.custom: "include file"
1010
---
@@ -29,4 +29,4 @@ The following limits apply to incidents in Microsoft Sentinel.
2929

3030
**Number of incidents per day:** There isn't a formal, hard limit on the number of incidents that can be created per day. A workspace's actual capacity for incidents depends on the storage capacity of the incident database, so the size of the incidents is as much a factor as their number.
3131

32-
However, a SOC that experiences the creation of more than *around* 3000 new incidents per day will in all likelihood find itself unable to keep up, and the database capacity will quickly be reached. In this situation, the SOC needs to focus on improving detection, triage, and automation, to get the count of daily new incidents to manageable levels.
32+
However, a SOC that experiences the creation of more than *around* 3000 new incidents per day will most likely find itself unable to keep up, and the database capacity will quickly be reached. In this situation, the SOC needs to find and fix any rules that create large numbers of incidents, to get the count of daily new incidents to manageable levels.

0 commit comments

Comments
 (0)