Question
What is the largest amount of text or observables I can submit to Threat Response?
Answer
Threat Response investigations support text input of up to 2000 characters. This limit applies at the API level, so it is in effect for the investigate UI, the browser plugin(s), and any integration pivots. Longer text inputs may not result in proper or timely harvesting of all included observables, and are not supported.
The relations graph is hard-limited to 200 nodes, including both investigated observables and returned enrichment items. Any more than that and the human eye and mind simply have trouble parsing the results. For that reason, and for performance reasons, we recommend no more than 50 observables be investigated at once.
