Skip to content
Notifications
Clear all

The UI keeps timing out on large time-range searches. Fix?

2 Posts
2 Users
0 Reactions
1 Views
(@benchmark_nerd_1337)
Reputable Member
Joined: 3 months ago
Posts: 222
Topic starter   [#22350]

I've been conducting a systematic evaluation of the CrowdStrike Falcon platform's threat intelligence query capabilities, specifically focusing on performance under load with large datasets. My primary workflow involves searching for IOCs and threat actor activity over extended time ranges (e.g., 90-180 days) to establish baselines for longitudinal threat campaigns. Consistently, I am encountering a critical failure point: the UI client times out, returning a generic "Request timed out" error, well before the backend query can complete.

My methodology is as follows:
* **Query:** A complex Boolean search combining multiple IOC types (hashes, domains, IPs) with actor names and malware families.
* **Time Range:** >90 days.
* **Result Set:** Expected result count is in the tens of thousands of events.
* **Environment:** Tested from multiple geographic regions using both the standard web UI and the Falcon SDK (`crowdstrike-falconpy`).

The failure is reproducible. The UI becomes unresponsive for 60-90 seconds before the timeout modal appears. Crucially, the same query via the API using pagination *does* eventually succeed, indicating the data retrieval is possible but the UI's request/rendering pipeline is not optimized for large, complex result sets.

**Key Performance Questions:**
1. Is there a undocumented hard timeout on the frontend HTTP request to the `/alerts/combined/alerts/v1` (or similar) endpoint? What is its value?
2. Does the platform employ any form of query result pagination or streaming for the graphical interface, or does it attempt to load the entire result set into the browser's memory before rendering?
3. Are there any server-side configuration parameters (e.g., `timeout`, `max_results`) that can be adjusted by an administrator to accommodate these types of operational intelligence queries?

The current behavior forces a suboptimal workflow where I must:
* Break my search into multiple, smaller time windows (e.g., 7-day increments).
* Abandon the UI entirely and write a custom script using the API with manual pagination.

Both are inefficient and hinder the ability to quickly visualize broad trends. For a platform at this scale, I would expect either asynchronous query handling (with a "download results" option) or robust client-side streaming.

Has anyone else in the community performed similar stress tests and developed a reliable configuration or workflow to circumvent this? I am particularly interested in any official or community-developed tools that can proxy these large queries, or any hidden UI parameters that might increase the timeout threshold.

numbers don't lie


numbers don't lie


   
Quote
(@annie82)
Estimable Member
Joined: 2 weeks ago
Posts: 78
 

That's a really interesting point about the API succeeding where the UI fails. I'm just starting to dig into Falcon for our team, and I'm already worried about hitting limits like this. When you run it via the API with pagination, how long does it actually take to get the full result set? Is it something you could realistically work with, or is it still too slow for practical use?



   
ReplyQuote