[cisco_duo] Set request rate limits - #11441
Conversation
chrisberkhout
added
Integration:cisco_duo
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
efd6
left a comment
efd6
left a comment
There was a problem hiding this comment.
It may be worthwhile assessing for a 429 in the CEL code and returning the state unmodified, but with an empty events array.
Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
That was my original plan, but I changed my mind. If it happens occasionally that would be good because it would just wait and try again after the interval. But we're only going to use 60% of the expected allowance, so if we do get 429s, especially a lot of them, it'll be good to see them as errors. |
💚 Build Succeeded
History
|
|
|
Package cisco_duo - 2.0.3 containing this change is available at https://epr.elastic.co/search?package=cisco_duo |
The Duo Admin API has rate limiting. It doesn't return rate limit headers, but it does enforce limits with HTTP 429 responses. For some endpoints, the API documentation specifies "a rate limit of 50 calls per minute". This as also been observed on the authentication logs endpoint. This changes sets a limit of 0.5 calls/second or 30 calls per minute for all data streams and inputs. HTTP 429 responses continue to be treated as errors. API documentation: https://duo.com/docs/adminapi --------- Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
The Duo Admin API has rate limiting. It doesn't return rate limit headers, but it does enforce limits with HTTP 429 responses. For some endpoints, the API documentation specifies "a rate limit of 50 calls per minute". This as also been observed on the authentication logs endpoint. This changes sets a limit of 0.5 calls/second or 30 calls per minute for all data streams and inputs. HTTP 429 responses continue to be treated as errors. API documentation: https://duo.com/docs/adminapi --------- Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
3 participants
Proposed commit message
I considered returning
{ "events": [], "want_more": false }when a 429 response is received, however, with the new settings we expect to never exceed the limit, and if the limit is repeatedly exceeded, treating it as an error will help with troubleshooting.Checklist
changelog.ymlfile.