> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/cortex-xsoar-service-limits.md).

# Cortex XSOAR service limits

Cortex XSOAR supports one or more tenants per customer: one for production, and one or more for development. The development tenant allows you to develop and test components (such as playbooks, automation scripts, and screen layouts) before they are deployed to production.

Indicator volume support differs between customers who own a TIM license and those who do not own a TIM license.

Cortex XSOAR production environment supports:

| Feature                 | Without a TIM license                                                                                                                                                                                                                                                                                                                                                                                                | With a TIM license                                                                                                                                                                                                                                                                                                                                                                                                   |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Incidents per day       | <p>24,000</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Up to 1000 an hour.</p><p>If the number of incidents exceeds the limit, they will be placed in a queue, not dropped.</p><p>These figures depend on the playbook design. If designed to run for hours and have many loops, the rate of ingestion may be significantly lower.</p></div> | <p>24,000</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Up to 1000 an hour.</p><p>If the number of incidents exceeds the limit, they will be placed in a queue, not dropped.</p><p>These figures depend on the playbook design. If designed to run for hours and have many loops, the rate of ingestion may be significantly lower.</p></div> |
| Total indicators stored | 3,000,000                                                                                                                                                                                                                                                                                                                                                                                                            | 100,000,000                                                                                                                                                                                                                                                                                                                                                                                                          |
| Incidents retention     | 6 months by default. For more information, see [Retention FAQs](/cortex-xsoar-8-retention-policy/cortex-xsoar-8-retention-policy-faqs/readme.md).                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                      |

Cortex XSOAR development environment supports:

| Feature                 | Without a TIM license                                                                                                                                                                                                                                                                                                                                                                                              | With a TIM license                                                                                                                                                                                                                                                                                                                                                                                                 |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Incidents per day       | <p>2000</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Up to 1000 an hour.</p><p>If the number of incidents exceeds the limit, they will be placed in a queue, not dropped.</p><p>These figures depend on the playbook design. If designed to run for hours and have many loops, the rate of ingestion may be significantly lower.</p></div> | <p>5000</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Up to 1000 an hour.</p><p>If the number of incidents exceeds the limit, they will be placed in a queue, not dropped.</p><p>These figures depend on the playbook design. If designed to run for hours and have many loops, the rate of ingestion may be significantly lower.</p></div> |
| Total indicators stored | 500,000                                                                                                                                                                                                                                                                                                                                                                                                            | 10,000,000                                                                                                                                                                                                                                                                                                                                                                                                         |
| Incidents retention     | 6 months by default. For more information, see [Retention FAQs](/cortex-xsoar-8-retention-policy/cortex-xsoar-8-retention-policy-faqs/readme.md).                                                                                                                                                                                                                                                                  |                                                                                                                                                                                                                                                                                                                                                                                                                    |

The development tenant has different technical specifications and should not be used for a production environment or stress testing.

{% hint style="info" %}

### Note

* You need to comply with any Guard Rail Alerts. For more information, see [View Guard Rails warnings and errors](/cortex-xsoar-8-saas/troubleshoot-and-reference/troubleshoot/view-guard-rails-warnings-and-errors.md).
* If you exceed the maximum number of incidents stored and ingested per day, you may experience slowness (if there are too many incidents being processed) and playbook executions and automations may be queued until there are sufficient resources available.
* For multi-tenant deployments, the same service limits apply to each child tenant.
* If you require a higher ingestion rate, contact Customer Support.
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/cortex-xsoar-service-limits.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.