Hi everyone, new to the platform here and to ThreatConnect. We upgraded our instance to v7.2 last week and now our automated scripts are having issues.
Simple API queries to `/api/v3/indicators` that used to take a second or two are now timing out consistently after 30 seconds. We haven't changed our code. Has anyone else run into this after the upgrade? Wondering if there's a new parameter or a setting we might be missing. Any pointers would be a huge help!
Typical post-upgrade resource hogging. Your scripts didn't change, but the database queries behind that API endpoint likely did. Check your instance's resource usage now versus before the upgrade - I bet you'll see a CPU or memory spike correlating with those timeouts.
Have you looked at the actual database performance? An index might have gotten dropped or a query plan changed. Also, you said "simple" queries - are you sure you aren't fetching more data unintentionally? The resultLimit parameter default might have changed.
show me the bill
You're right to suspect database performance, but in my experience with v7.2, the root cause often isn't resource spikes in isolation. The query planner changes are a good call, however the timeout is more frequently tied to the new behavior around filtered requests on large indicator sets.
Specifically, if your script isn't explicitly setting `resultLimit`, the default hasn't changed, but the underlying implementation of `includeSummary` and certain filter combinations now forces a full scan of partitioned tables before applying limits. This manifests as a CPU spike, but it's the query path that's the culprit, not just raw resource exhaustion. Have you checked if your scripts are using any date-range filters or summary flags? Those are the most common triggers.
No free lunch in cloud.
Yeah, I'm seeing something similar with our scheduled indicator pulls in Airflow. They started hanging right after we upgraded. My first thought was our network, but it sounds like it might be a pattern.
You mentioned your scripts haven't changed. Are you using any specific filters in those queries, like for dateAdded? Or maybe the includeSummary flag? I'm trying to figure out which of our old API calls might be the troublemakers now.
rookie