Questions About Cortex XSIAM API Limits (IOCs Insertion & Retrieval, Rate Limiting)

[Bharat]

Hi Community,

We are integrating with the Cortex XSIAM API and would appreciate some clarity on the following points:

1. Insert IOCs
   We plan to use the endpoint:
   https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM-REST-API/Insert-or-update-IOCs
   What is the maximum number of IOCs that can be inserted in a single API request to Cortex XSIAM?

2. API Rate Limiting
   Is there any rate limiting enforced on the following endpoints? If so, what are the specific thresholds?

   • IOCs: get, insert, delete

   • Alerts: get

3. IOC Retrieval Limit (search_to confusion)
   While using this endpoint:
   https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM-REST-API/Get-Indicators-IOCs
   The parameter search_to is somewhat unclear, especially when it mentions values >100.
   What is the maximum number of IOCs that can be retrieved in a single API call?

Any official documentation links or guidance from experience would be greatly appreciated.

Thanks in advance!

[PA_nts]

Hi Bharat,

some good reading here compliments of AI :-).. 

1. Insert IOCs

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Enterprise-Plus-Documentation/W...

• Endpoint: Insert or update IOCs
• Max per request: 10,000 IOCs  (answer to Q2)
• Max IOCs per call: 10,000
• Total IOC capacity: XSIAM supports up to 4,000,000 IOCs in the system
•  

some useless info.. but this should not use any compute units.. unless you want to run IOC queries via API (which we do) and can get eaten up very quickly. 

rgds