Google SecOps SIEM Stats Query API Limit

Hi ​@donkos , UDM Search and Stats Search Quotas: Both standard UDM searches and statistics searches (StatsUDMSearch) are subject to API quotas.

We are in the process of increasing the QPH limits for all customer . This will be available by May mid . Post the changes the Quota limits will be

UI: 1000QPH
API: 2000QPH

Yes, the SOAR integration if using API, then same QPI quota applies 

Thanks for the clarification here.

Just wanted to check whether the quota increase has now been rolled out globally?

We’re still seeing behavior that looks consistent with the previous API limits when using the Google Chronicle SOAR integration (particularly around Execute UDM Search / StatsUDMSearch actions), so I wanted to confirm whether the 2000 QPH API quota is already active for all tenants or if rollout is still ongoing.

Also — is there any way for customers to verify their currently applied quota limits from the SecOps side?

Hi ​@alonm , According to the official documentation, 2000 QPH ought to be enabled. When a limit is reached, the web interface shows a quota error, while API access triggers a 429 RESOURCE_EXHAUSTED error. To determine your current quota and usage levels, you must submit a request.

https://docs.cloud.google.com/chronicle/docs/investigation/udm-search

Hi ​@rupinderv,
Appreciate the prompt response.
I’m experiencing lower quota than the mentioned 2000QPH especially for aggregation queries (match:/outcome: etc). I’m using the v1beta udmSearch endpoint. I’m getting the 429s long before the 2000 mark and my concurrency is basically 1.
I’m also seeing two different types of quota error messages:
1. "You have reached the maximum allowed quota for this operation. Please wait until the quota is refreshed..."
2. "Resource has been exhausted (e.g. check quota)."

Could you please clarify?