Query quotas and duplicate queries
The system measures quotas at the group level and resets them each month. Understanding what counts as quota consumption helps you optimize your usage of Iris Investigate.
For complete details on quota consumption policies, including duplicate query policies, search hash reloading, and revisiting search nodes, consult the Iris API Rate Limits documentation.
Pivot Engine queries in the Iris Investigate UI
Section titled “Pivot Engine queries in the Iris Investigate UI”Learn more about search methods and pivoting techniques.
Activities that consume quota
Section titled “Activities that consume quota”The following activities consume your quota:
- Executing an omnisearch (from landing or search pages) that returns results.
- Executing an advanced search that returns results.
- Sending a result to the Pivot Engine (including narrow, expand, new, and exclude functions).
- Revisiting a search node more than 30 days after its creation.
- Loading new pages in the Pivot Engine.
- Sorting Pivot Engine results.
Activities that don’t consume quota (duplicate queries)
Section titled “Activities that don’t consume quota (duplicate queries)”The following activities don’t consume your quota:
- Queries with identical filter, sorting, and page parameters made within 30 days of a previous query that counted toward quota.
- Reloading a search hash within 30 days of its creation.
Passive DNS (pDNS) queries in the Iris Investigate UI
Section titled “Passive DNS (pDNS) queries in the Iris Investigate UI”Learn more about pDNS queries and flexible search.
Activities that consume quota
Section titled “Activities that consume quota”The following activities consume your quota:
- Executing a search query that returns results (from either the search field or popovers throughout the UI).
- Executing/triggering the load more (infinite scroll) function in search results.
- Revisiting a search node more than 30 days after its creation.
Activities that don’t consume quota (duplicate queries)
Section titled “Activities that don’t consume quota (duplicate queries)”The following activities don’t consume your quota:
- Queries with identical parameters (filters, sorting, pagination) made within 30 days of a previous query that counted toward quota.
Queries in the Iris Investigate API
Section titled “Queries in the Iris Investigate API”Activities that consume quota
Section titled “Activities that consume quota”The following activities consume your quota:
- Executing a query.
- Loading additional pages of results.
Activities that don’t consume quota (duplicate queries)
Section titled “Activities that don’t consume quota (duplicate queries)”The following activities don’t consume your quota:
- Identical queries made within 1 hour of a previous query that counted toward quota.