Skip to content

DOCS-72 - Cloud SIEM rule limits documentation #5159

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

DOCS-72 - Cloud SIEM rule limits documentation #5159

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
48f90ad
Add rule limits info
jpipkin1 Mar 10, 2025
4cc803a
Merge branch 'main' into docs-72-cloud-siem-rule-limits
jpipkin1 Mar 21, 2025
c16cdfa
Merge branch 'main' into docs-72-cloud-siem-rule-limits
jpipkin1 May 30, 2025
8c67d34
Merge branch 'main' into docs-72-cloud-siem-rule-limits
jpipkin1 Jun 16, 2025
6596cc5
Merge branch 'main' into docs-72-cloud-siem-rule-limits
jpipkin1 Jun 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 0 additions & 8 deletions docs/cse/rules/rules-status.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,12 +75,6 @@ Sometimes there may be a problem creating a baseline for a [first seen rule](/do

Limits are set on how often a rule fires so that the system is not overloaded. For example, if a rule fires too many signals in an hour, it can cause performance problems for all rule processes. If a rule exceeds a limit, its rule status changes from Active to Failed and the rule is disabled.

| Type | Limit |
| :-- | :-- |
| Signals per hour | 100K |
| Signals per 24 hours | 1M |

<!-- For DOCS-72 - Rule limits
| Type | Limit |
| :-- | :-- |
| Total allowed custom rules of each [rule type](/docs/cse/rules/about-cse-rules/#rule-types) | 100 - Tier 1 <br/>200 - Tier 2<br/>500 - Tier 3 |
Expand All @@ -98,8 +92,6 @@ Limits are set on how often a rule fires so that the system is not overloaded. F
Rule limits can be higher if you are in a higher tenant tier level. If you have questions about what your tenant tier level is, contact your Sumo Logic account representative or [contact Sumo Logic Support](https://support.sumologic.com/support/s/).
:::

-->

## Query for rule status changes

You can query audit logs for rule status changes. For more information about querying audit logs, see [Cloud SIEM Audit Logging](/docs/cse/administration/cse-audit-logging/) and [Cloud SIEM audit log definitions](/docs/manage/security/audit-indexes/documentation-audit-log-definitions/#cloud-siem-audit-log-definitions).
Expand Down