Cortex XSOAR Service Limits - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
8
Creation date
2023-11-02
Last date published
2024-02-28
Category
Administrator Guide
Abstract

Describes the service limits for Cortex XSOAR cloud.

Cortex XSOAR supports one or more tenants per customer: one for production, and one or more for development. The development tenant allows you to develop and test components (such as playbooks, automation scripts, and screen layouts) before they are deployed to production.

Indicator volume support differs between customers who own a TIM license and those who do not own a TIM license.

Cortex XSOAR production environment supports:

Feature

Without a TIM license

With a TIM license

Incidents per day

10,000

Rate limit of 100 incidents ingested per minute

10,000

Rate limit of 100 incidents ingested per minute

Total indicators stored

3,000,000

100,000,000

Incidents retention

180 days by default. For more information, see Retention FAQs.

Cortex XSOAR development environment supports:

Feature

Without a TIM license

With a TIM license

Incidents per day

2000

Rate limit of 100 incidents ingested per minute

5000

Rate limit of 100 incidents ingested per minute

Total indicators stored

500,000

10,000,000

Incidents retention

180 days by default. For more information, see Retention FAQs.

The development tenant has different technical specifications and should not be used for a production environment or stress testing.

Note

For multi-tenant deployments, the same service limits apply to each child tenant.