Skip to content

Commit f9cad8b

Browse files
Update sentinel-service-limits.md
updated TI upload API terms to include objects instead of just indicators updated TI file upload terms updated watchlist limits for readability
1 parent 06373bb commit f9cad8b

File tree

1 file changed

+9
-9
lines changed

1 file changed

+9
-9
lines changed

articles/sentinel/sentinel-service-limits.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -115,16 +115,16 @@ The following limit applies to threat intelligence in Microsoft Sentinel. The li
115115
|Description | Limit |Dependency|
116116
-------------------------|--------------------|--------------------|
117117
| Indicators per call that use Graph security API | 100 indicators |Microsoft Graph security API|
118-
| CSV indicator file import size | 50MB | none|
119-
| JSON indicator file import size | 250MB | none|
118+
| CSV TI object file import size | 50MB | none|
119+
| JSON TI object file import size | 250MB | none|
120120

121-
## TI upload indicators API limits
121+
## TI upload API limits
122122

123-
The following limit applies to the threat intelligence upload indicators API in Microsoft Sentinel.
123+
The following limit applies to the threat intelligence upload API in Microsoft Sentinel.
124124

125125
|Description | Limit |Dependency|
126126
-------------------------|--------------------|--------------------|
127-
| Indicators per request | 100 indicators | |
127+
| STIX objects per request | 100 objects | |
128128
| Requests per minute | 100 | |
129129

130130
## User and Entity Behavior Analytics (UEBA) limits
@@ -137,16 +137,16 @@ The following limit applies to UEBA in Microsoft Sentinel. The limit for UEBA in
137137

138138
## Watchlist limits
139139

140-
The following limits apply to watchlists in Microsoft Sentinel. The limits are related to the dependencies on other services used by watchlists.
140+
The following limits apply to watchlists in Microsoft Sentinel. Watchlists larger than 3.8 MB are considered large. The limits are related to the dependencies on other services used by watchlists.
141141

142142
|Description | Limit |Dependency|
143143
|--|-------------------------|--------------------|
144-
|Upload size limit for local file| 3.8 MB per file (Watchlists larger than 3.8 MB are considered large) |Azure Resource Manager
144+
|Upload size limit for local file| 3.8 MB per file |Azure Resource Manager
145145
|Line entry in the CSV file |10,240 characters per line|Azure Resource Manager|
146146
|Total size of a single row | 10 Kb | Log Analytics|
147147
|Upload size for large watchlist files in Azure Storage |500 MB per file|Azure Storage|
148-
|Total number of active watchlist items per workspace. When the max count is reached, delete some existing items to add a new watchlist.|10 million active watchlist items|Log Analytics|
149-
|Total rate of change of all watchlist items per workspace (create, update, and delete operations) | 100,000 (1% of max watchlist items) changes per month|Log Analytics|
148+
|Total number of active watchlist items per workspace</br>When the max count is reached, delete some existing items to add a new watchlist.|10 million active watchlist items|Log Analytics|
149+
|Total rate of change of all watchlist items per workspace</br>(create, update, and delete operations) | 100,000 changes per month</br>(1% of max active watchlist items)|Log Analytics|
150150
|Number of large watchlist uploads per workspace at a time|One large watchlist|Azure Cosmos DB|
151151
|Number of large watchlist deletions per workspace at a time|One large watchlist|Azure Cosmos DB|
152152

0 commit comments

Comments
 (0)