Event Volume Control using Rate Limiting
CRS provides rate-limiting controls to help prevent event flooding and reduce excessive event traffic to the Qualys Enterprise TruRisk™ Platform.
Rate limiting can be applied at two levels:
- FIM Rate Limiting – Controls the generation of file events for specific files, processes, or pods.
- Global Rate Limiting – Controls the total number of runtime events (File, Process, and Network) sent from a Runtime Sensor to the Qualys Enterprise TruRisk™ Platform.
Rate limiting is enforced locally by the CRS before events are transmitted to the Qualys Enterprise TruRisk™ Platform.
FIM Rate Limiting
File Integrity Monitoring (FIM) rate limiting allows you to control the frequency at which file events are generated and sent to the Qualys Enterprise TruRisk™ Platform.
Benefits
- Reduces repetitive file events
Example: A file is opened 1,000 times in a minute. - Prevents noisy files from flooding the backend
Example: A log file is updated thousands of times per minute. - Controls event generation at the policy level
Example: Duplicate file events can be suppressed independently based on the configured scope (pod, process, etc.).
You can configure rate limiting as part of a tracing policy by specifying:
rate-limit: "1m"
The rate limit applies independently based on the configured scope.
Supported Rate-Limit Scopes
| Scope | Description |
|---|---|
| pod | Applies the rate limit per pod Example Pod-Level Rate Limiting rate-limit: "1m"
|
| process | Applies the rate limit per process Example Process-Level Rate Limiting rate-limit: "1m"
|
You can not disable rate limiting by setting the rate limit value to 0 or 0s. A default rate limit of 1 minute is always enforced.
Global Rate Limiting
Global rate limiting controls the overall volume of runtime events sent from a Runtime Sensor to the Qualys Enterprise TruRisk™ Platform.
Benefits
- Prevents overall event flooding
Example: A workload suddenly generates thousands of file, process, and network events during a spike in activity. Global rate limiting prevents all events from being forwarded to the backend at once. - Protects backend ingestion capacity
Example: Global rate limiting caps the number of events forwarded to the backend, helping maintain a manageable event volume even during periods of high event generation. - Controls event transmission at the sensor level
Example: If multiple applications on a node generate a large volume of runtime events, the Runtime Sensor enforces a global limit before sending events to the backend, ensuring a consistent event flow.
Unlike FIM rate limiting, global rate limiting does not check whether events are duplicates. Instead, it maintains a count of all File, Process, and Network events generated during a defined time window.
The Runtime Sensor enforces global rate limits locally before events are sent to the Qualys Enterprise TruRisk™ Platform.
Default time window: 1 minute
Applies to:
- File events
- Process events
- Network events
Global rate limiting is enabled by default and does not require any changes to runtime policies.
Configuring Global Rate Limits
Configure the global rate limit using the following Helm chart parameter:
runtimeSensor: event
GlobalRateLimit: <value>Valid Values
| Setting | Value |
|---|---|
| Minimum | 10 |
| Maximum | 500 |
| Default | 200 |
If a value lower than the minimum limit is provided, CRS automatically adjusts it to the minimum supported value.
If a value exceeds the maximum supported limit, CRS automatically adjusts it to the maximum supported value and records a warning in the sensor logs.
Example:
WARN QUALYS_EVENT_GLOBAL_RATE_LIMIT value too high: 600. Thresholding it to 500
Interaction Between FIM and Global Rate Limiting
FIM rate limiting and Global rate limiting operate independently and can be used together.
- FIM rate limiting controls event generation for specific policies.
- Global rate limiting controls the total number of runtime events transmitted by the sensor.
Both mechanisms can be enabled simultaneously to provide granular and sensor-wide event control.