Hunting API error: Query execution has exceeded the allowed limits.

[kavi_t]

I encounter an intermittent error when running a hunting query on https://security.microsoft.com/advanced-hunting. Although the query sometimes executes successfully, it occasionally produces the following error:

"Query execution has exceeded the allowed limits. The query execution was preempted. This could possibly be due to high CPU and/or memory resource consumption. Optimize your query by following best practices and try again."

I'm curious if there are any other restrictions on the number of requests other than mentioned in Doc? Upon reviewing the Query resource, it indicates 0 instances of excessive usage in the last 30 days for both API and portal.

[#2]

Hi @kavi_t,

The error message "Query execution has exceeded the allowed limits" can occur from various reasons.

These reasons can be:

1. CPU Throttling:
   If queries in the same tenant surpass allocated CPU resources, the service may block queries until the next daily or 15-minute cycle.
2. Timeouts:
   Queries running for more than three minutes may timeout and return an error.
3. Result Size Limit Exceeded:
   The aggregate size of the result set may surpass the maximum limit, especially if truncation can't reduce it to an acceptable size.
4. Excessive Resource Consumption:
   Queries consuming excessive resources may be halted.

Handle errors in advanced hunting for Microsoft Defender XDR | Microsoft Learn

Regarding limitations on the number of requests, the Microsoft Advanced Hunting API has specific restrictions:

• Queries are limited to the last 30 days' data.
• Results include a maximum of 100,000 rows.
• Execution limits per tenant include 45 calls per minute and 1500 calls per hour.
• Execution time is capped at 10 minutes every hour and 3 hours per day.
• A single request's maximal execution time is 200 seconds.
• The maximum query result size cannot exceed 124 MB.

Advanced Hunting API | Microsoft Learn

If encountering this error persistently, consider optimizing or breaking down the query.

Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.

If the post was useful in other ways, please consider giving it Like.

Kindest regards,

Leon Pavesic
(LinkedIn)