> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.5/troubleshoot-and-reference/troubleshoot/view-service-limit-errors-and-warnings-in-the-guard-rails-page.md).

# View service limit errors and warnings in the Guard Rails page

The Cortex XSOAR **Guard Rails** page provides a list of usage limitation errors and warnings that occur during incident ingestion, investigation, and response. It helps to keep your environment stable and prevent actions that can cause major performance degradation or instability.

Cortex XSOAR has service rate limits for the number of incidents and indicators that can be ingested and stored. The **Guard Rails** page indicates when incident or indicator size exceeds predefined service limits and may affect performance.

<details>

<summary>Cortex XSOAR service rate limits for incident and indicators</summary>

Cortex XSOAR supports one or more tenants per customer: One for production, and one or more for development. The development tenant allows you to develop and test components (such as playbooks, automation scripts, and screen layouts) before they are deployed to production.

Indicator volume support differs between customers who own a TIM license and those who do not own a TIM license.

**Production tenant service limits**

| Feature                 | Without a TIM license                                               | With a TIM license                                                  |
| ----------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------- |
| Incidents per day       | <p>10,000</p><p>Rate limit of 100 incidents ingested per minute</p> | <p>10,000</p><p>Rate limit of 100 incidents ingested per minute</p> |
| Total indicators stored | 3,000,000                                                           | 100,000,000                                                         |

**Development tenant service limits**

| Feature                 | Without a TIM license                                             | With a TIM license                                                |
| ----------------------- | ----------------------------------------------------------------- | ----------------------------------------------------------------- |
| Incidents per day       | <p>2000</p><p>Rate limit of 100 incidents ingested per minute</p> | <p>5000</p><p>Rate limit of 100 incidents ingested per minute</p> |
| Total indicators stored | 500,000                                                           | 10,000,000                                                        |

The development tenant has different technical specifications and should not be used for a production environment or stress testing.

{% hint style="info" %}

### Note

For multi-tenant deployments, the same service limits apply to each child tenant.
{% endhint %}

</details>

#### Cortex XSOAR Guard Rails page

The Cortex XSOAR Guard Rails page displays a table with a list of service limit errors and warnings and their details.

An error occurs when a service limit is exceeded. For example, an error can be generated for exceeding the size limit of an attachment or for exceeding the number of entries per incident.

A warning occurs when approaching the service limit. For example, a warning can be generated when the number of entries per incident is approaching the service limit or the number of linked incidents is approaching the service limit.

The service limits are defined out-of-the-box. Contact Cortex XSOAR support if you need to change the values for your service limits.

Access the Guard Rails page from Cortex XSOAR Settings & Info → **Settings** → **System**.

The table shows the following information:

* **ID**: (by default hidden) The log number.
* **Timestamp**: The date time the error or warning occurred.
* **Type**: The object type the error or warning occurred on, for example incident or indicator.
* **Subtype**: The object sub type (N/A if it doesn't exist), for example entries or attachments.
* **Severity**: Whether the item is an error or a warning.
* **Object ID**: The ID of the restricted object.
* **Count**: The number of times a specific item occurred in the last calendar day.
* **Description**: A short description of the error or warning.

{% hint style="info" %}

### Note

Identical messages generated within the same day are not duplicated in the table, only the **Count** is updated and the **Timestamp** shows the date time the error or warning occurred for the first time. A count greater than one indicates an identical error or warning occurred more than once within the same day.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.5/troubleshoot-and-reference/troubleshoot/view-service-limit-errors-and-warnings-in-the-guard-rails-page.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
