Handle large alerts

Most security alerts ingested through connectors or webhooks don't impact performance. The system efficiently ingests alerts up to 28 MB. Alerts exceeding this threshold trigger an automatic, phased mitigation process to prevent system overload and ensure processing efficiency.

The platform executes each phase sequentially, only initiating the next if the previous one fails to resolve the size issue. Trimmed alerts display a system notification.

Phased approach for handling large alerts

The following is a breakdown of how to handle large alerts in a phased approach to prevent system overload and ensure efficient processing:

1. Trim longest values: Detect and shorten the longest string values within every event field.
2. Trim field count: Reduce the total number of fields in the alert to a maximum of 100 fields.
3. Trim event count: Reduce the total number of events in the alert to a maximum of 50 events.

Database parameters control these default trim values. For information about these values, see Service limits.

To update parameter values, contact Google Support.