According to the official documentation, the multi-event rules capacity under the “Enterprise” license is 125 rules. However, we have noticed that in a few of our customer environments licensed under the Enterprise license, the multi-event rules quota has been increased to 200. Is this an official update? If so, why has it not been mentioned in any of the release notes or official documentation yet?
Best answer by kylechamplin
Package | Previous | Current
Enterprise | 125 | 200
Enterprise+ | 200 | 400
Looks like the docs updates/changes didn’t get published, I’ll check on that this week. The main impetus for this change was a extremely positive increase in the adoption of composite detections (which consumes ME rule quota):
https://docs.cloud.google.com/chronicle/docs/detection/composite-detections
+11Hi
Although the documentation lists the Enterprise limit as 125, I found that multi-event rule capacities are defined by License Tiers.
Hope this helps.
+1
Package | Previous | Current
Enterprise | 125 | 200
Enterprise+ | 200 | 400
Looks like the docs updates/changes didn’t get published, I’ll check on that this week. The main impetus for this change was a extremely positive increase in the adoption of composite detections (which consumes ME rule quota):
https://docs.cloud.google.com/chronicle/docs/detection/composite-detections
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
