Google chronicle rule quota limitation

There is a quota on multiple event rules that you can have in your tenant - https://docs.cloud.google.com/chronicle/docs/secops/secops-packages#:~:text=Detection%20rules%20enabled. It looks like that quota has been reached for your SecOps package.

Hi ​@arv261095,

Looks like you’ve reached the maximum amount of Multi-Event Rules quota, which is 125/125. These are live-enabled multi-event rules.

The below is some documentation on YARA-L 2.0 query reference library to help understand the difference between  single and multi-event rules: https://docs.cloud.google.com/chronicle/docs/yara-l/yara-l-2-0-examples
 

You’ll have to turn off some multi-event rules that are currently live, or ask support if your quota can be increased.

Kind Regards,

Ayman

Hello, some details and links to our public documentation.

• This document explains the capacity limits for Curated Detections (rule sets created by Google). It details how capacity is calculated based on rule set complexity and weight, not just a raw count. The default capacity and how to view current usage are also covered.

  • https://cloud.google.com/chronicle/docs/detection/rules-capacity

• Understand rule quotas: This document focuses on the quotas for custom rules written in YARA-L. It outlines the number of rules allowed based on the type of rule (e.g., Single-Event, Multi-Event) and potentially the customer's license tier.

  • https://cloud.google.com/chronicle/docs/detection/rule-quotas

• Service limits: This page provides details on various other limits within Google Security Operations, including API rate limits that can affect rule management and detection retrieval.

  • https://cloud.google.com/chronicle/docs/reference/service-limits

Is there a way to filter multi-event rules in chronicle ?

Not within the editor. Within a native dashboard, you could filter by adding this statement:

detection.detection.rule_type = "MULTI_EVENT”

From the rules dashboard, you could also sort by type:

Can achieving rule get us back to our quota limit does that help??

And is there any way to delete rule completely ??

Yes, archiving a rule will remove it from counting towards the quota. For deletion, you can file a support case.