Hunting API error: Query execution has exceeded the allowed limits.

Hi kavi_t,

The error message "Query execution has exceeded the allowed limits" can occur from various reasons.

These reasons can be:

1. CPU Throttling:
   If queries in the same tenant surpass allocated CPU resources, the service may block queries until the next daily or 15-minute cycle.
2. Timeouts:
   Queries running for more than three minutes may timeout and return an error.
3. Result Size Limit Exceeded:
   The aggregate size of the result set may surpass the maximum limit, especially if truncation can't reduce it to an acceptable size.
4. Excessive Resource Consumption:
   Queries consuming excessive resources may be halted.

Handle errors in advanced hunting for Microsoft Defender XDR | Microsoft Learn

Regarding limitations on the number of requests, the Microsoft Advanced Hunting API has specific restrictions:

• Queries are limited to the last 30 days' data.
• Results include a maximum of 100,000 rows.
• Execution limits per tenant include 45 calls per minute and 1500 calls per hour.
• Execution time is capped at 10 minutes every hour and 3 hours per day.
• A single request's maximal execution time is 200 seconds.
• The maximum query result size cannot exceed 124 MB.

Advanced Hunting API | Microsoft Learn

If encountering this error persistently, consider optimizing or breaking down the query.