|
Billing |
- The basic edition does not support the value-added packages. To use functions in the value-added packages, upgrade the basic edition to the standard or professional edition.
- Value-added packages cannot be used independently.
- To purchase a value-added package, purchase the standard or professional edition first.
- If you unsubscribe from the pay-per-use professional edition, the system automatically unsubscribes from the value-added packages.
- If you unsubscribe from the yearly/monthly standard or professional edition, you need to manually unsubscribe from the value-added packages you have.
|
|
Managed environments |
- Edge sites, such as IEC, DeC, and IES, cannot be managed.
- Only the default project can be managed. Sub-projects cannot be managed.
- Resources cannot be managed by EPS.
|
|
Workspaces |
- Paid SecMaster: A maximum of five workspaces can be created for a single account in a single region.
- Free SecMaster: Only one workspace can be created for a single account in a single region.
- Permanent deletion of workspaces: Workspaces are deleted immediately and cannot be restored.
- Workspace agencies:
- A maximum of one workspace agency view can be created for an account in a region.
- A maximum of 150 workspaces from different regions and accounts can be managed by a workspace agency view.
- A maximum of 10 agencies can be created under a single account.
- Currently, performing operations in different workspaces in multiple windows of the same browser is not supported.
|
|
Data spaces/pipelines |
- A maximum of five data spaces can be created in a workspace in a region for a single account.
- A maximum of 20 pipelines can be created in a data space in a region for a single account.
|
|
Security reports |
A maximum of 10 security reports (including daily, weekly, and monthly reports) can be created in a single workspace of a single account. |
|
Alert models |
- A maximum of 100 alert models can be created in a single workspace under a single account in a single region.
- The running interval of an alert model must be greater than or equal to 5 minutes, and the time range for querying data must be less than or equal to 14 days.
|
|
Query and analysis |
- A maximum of 500 results can be returned for a single analysis query.
- A maximum of 50 shortcut queries can be created in a pipeline. That is, a maximum of 50 query analysis criteria can be saved as shortcut queries.
- If there are over 50,000 results for a single query, the accuracy may decrease. In this case, you can select a short time range or apply more filter criteria to reduce the number of query results.
- In aggregation queries (for example, GROUP BY statement) based on several fields, the default number of buckets for the second field is 10. If more than 10 buckets are generated, part of qualified data will be lost. In this case, the query results are not accurate.
|
|
Incidents, alerts, indicators, and vulnerabilities |
- In a workspace of a single account, a maximum of 100 new alerts, incidents, indicators, or vulnerabilities can be added each day.
- In a workspace of a single account, a maximum of 100 alerts can be converted into incidents each day.
|
|
Playbooks |
- In a single workspace of an account, the scheduling frequency of a single playbook is greater than or equal to 5 minutes.
|
|
Playbook and workflow instances |
The maximum number of retries within a day for a single workspace of a single account is as follows:
- Manual retries: 100. After a retry, the playbook cannot be retried until the current execution is complete.
- API retries: 100. After a retry, the playbook cannot be retried until the current execution is complete.
|
|
Classification & mapping |
- In a single workspace of a single account, a maximum of 50 classification & mapping templates can be created.
- In a single workspace of a single account, the proportion of a classification to its mappings is 1:100.
- A maximum of 100 classifications and mappings can be added to a workspace of a single account.
|
