Skip to content

Commit df1a752

Browse files
committed
Added disclaimer on AWSCT throttling
1 parent 5c71190 commit df1a752

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

articles/sentinel/connect-aws.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ ms.author: yelevin
2222
Use the AWS connector to stream all your AWS CloudTrail events into Azure Sentinel. This connection process delegates access for Azure Sentinel to your AWS resource logs, creating a trust relationship between AWS CloudTrail and
2323
Azure Sentinel. This is accomplished on AWS by creating a role that gives permission to Azure Sentinel to access your AWS logs.
2424

25+
> [!NOTE]
26+
> AWS CloudTrail has [built-in limitations](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html) in its LookupEvents API. It allows no more than two transactions per second (TPS) per account, and each query can return a maximum of 50 records. Consequently, if a single tenant constantly generates more than 100 records per second in one region, backlogs and delays in data ingestion will result.
27+
2528
## Prerequisites
2629

2730
You must have write permission on the Azure Sentinel workspace.

0 commit comments

Comments
 (0)