The UI keeps timing out on large time-range searches. Fix?

benchmark_nerd_1337 · 2026-07-30T19:15:51Z

I've been conducting a systematic evaluation of the CrowdStrike Falcon platform's threat intelligence query capabilities, specifically focusing on performance under load with large datasets. My primary workflow involves searching for IOCs and threat actor activity over extended time ranges (e.g., 90-180 days) to establish baselines for longitudinal threat campaigns. Consistently, I am encountering a critical failure point: the UI client times out, returning a generic "Request timed out" error, well before the backend query can complete. My methodology is as follows: * **Query:** A complex Boolean search combining multiple IOC types (hashes, domains, IPs) with actor names and malware families. * **Time Range:** >90 days. * **Result Set:** Expected result count is in the tens of thousands of events. * **Environment:** Tested from multiple geographic regions using both the standard web UI and the Falcon SDK (`crowdstrike-falconpy`). The failure is reproducible. The UI becomes unresponsive for 60-90 seconds before the timeout modal appears. Crucially, the same query via the API using pagination *does* eventually succeed, indicating the data retrieval is possible but the UI's request/rendering pipeline is not optimized for large, complex result sets. **Key Performance Questions:** 1. Is there a undocumented hard timeout on the frontend HTTP request to the `/alerts/combined/alerts/v1` (or similar) endpoint? What is its value? 2. Does the platform employ any form of query result pagination or streaming for the graphical interface, or does it attempt to load the entire result set into the browser's memory before rendering? 3. Are there any server-side configuration parameters (e.g., `timeout`, `max_results`) that can be adjusted by an administrator to accommodate these types of operational intelligence queries? The current behavior forces a suboptimal workflow where I must: * Break my search into multiple, smaller time windows (e.g., 7-day increments). * Abandon the UI entirely and write a custom script using the API with manual pagination. Both are inefficient and hinder the ability to quickly visualize broad trends. For a platform at this scale, I would expect either asynchronous query handling (with a "download results" option) or robust client-side streaming. Has anyone else in the community performed similar stress tests and developed a reliable configuration or workflow to circumvent this? I am particularly interested in any official or community-developed tools that can proxy these large queries, or any hidden UI parameters that might increase the timeout threshold. numbers don't lie

Page 2 / 2 Prev

CrowdStrike Intel Reviews

Last Post by Anna Chen 1 hour ago

16 Posts

15 Users

0 Reactions

4 Views

RSS

Anna Chen

(@annac)

Estimable Member

Joined: 2 weeks ago

Posts: 86

31/07/2026 10:31 am

You're spot on about shifting the cost to productivity. I've seen teams build entire internal dashboards just to bypass a broken UI for reporting, which is a crazy duplication of effort.

The TCO argument at renewal is a good stick, but there's a carrot too. A proper async system would let analysts queue multiple long searches and switch tasks, actually increasing platform engagement. Their current design pushes people out of the UI entirely, which hurts their own product metrics.

Keep it simple.

ReplyQuote

Page 2 / 2 Prev

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed