Questions About Cortex XSIAM API Limits (IOCs Insertion & Retrieval, Rate Limiting)

Bharat — Sat, 06 Sep 2025 15:19:18 GMT

Hi Community,

We are integrating with the Cortex XSIAM API and would appreciate some clarity on the following points:

Insert IOCs
We plan to use the endpoint:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM-REST-API/Insert-or-update-IOCs
What is the maximum number of IOCs that can be inserted in a single API request to Cortex XSIAM?
API Rate Limiting
Is there any rate limiting enforced on the following endpoints? If so, what are the specific thresholds?
- IOCs: get, insert, delete
- Alerts: get
IOC Retrieval Limit (search_to confusion)
While using this endpoint:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM-REST-API/Get-Indicators-IOCs
The parameter search_to is somewhat unclear, especially when it mentions values >100.
What is the maximum number of IOCs that can be retrieved in a single API call?

Any official documentation links or guidance from experience would be greatly appreciated.

Thanks in advance!

Re: Questions About Cortex XSIAM API Limits (IOCs Insertion & Retrieval, Rate Limiting)

PA_nts — Wed, 10 Sep 2025 10:57:54 GMT

Hi Bharat,

some good reading here compliments of AI :-)..

1. Insert IOCs

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Enterprise-Plus-Documentation/What-s-an-IOC

Endpoint: Insert or update IOCs
Max per request: 10,000 IOCs (answer to Q2)
Max IOCs per call: 10,000
Total IOC capacity: XSIAM supports up to 4,000,000 IOCs in the system

some useless info.. but this should not use any compute units.. unless you want to run IOC queries via API (which we do) and can get eaten up very quickly.

rgds

topic Questions About Cortex XSIAM API Limits (IOCs Insertion & Retrieval, Rate Limiting) in Cortex XSIAM Discussions

Questions About Cortex XSIAM API Limits (IOCs Insertion & Retrieval, Rate Limiting)

Re: Questions About Cortex XSIAM API Limits (IOCs Insertion & Retrieval, Rate Limiting)