Limits

Your organisation has limits on what it can use. This page lists each limit: how much it holds, what it counts, when it resets, what you see when you reach it, and whether a top-up adds to it.

A limit that resets, resets at 00:00 UTC on the 1st of the month. Settings shows your submissions and your network traffic for the month under Usage.

All limits

Limit	How much	Counted for	Resets	When you reach it	Top-up adds
Submissions in a month	500 submissions	Your organisation	On the 1st of the month	livewells refuses the submission and says that your organisation has used all its submissions for this month.	250 submissions
Network traffic in a month	40 GiB	Your organisation	On the 1st of the month	livewells refuses a new session and says that your organisation has used its network traffic for this month. A session that runs ends its network at the limit, and its case says so.	10 GiB for 250 submissions
Threat intelligence checks in a month	3,000 credits	Your organisation	On the 1st of the month	The case shows "Threat intelligence budget for this month is used."	Nothing
Threat intelligence checks in a day	600 credits	Your organisation	At 00:00 UTC each day	The case shows the day limit and how many domains and addresses were not checked.	Nothing
Threat intelligence checks in an hour	150 credits	Your organisation	As checks leave the hour	The case shows the hour limit and how many domains and addresses were not checked.	Nothing
Threat intelligence checks in a case	60 credits	One case	Each case	The case shows how many domains and addresses were not checked.	Nothing
Network traffic in a session	256 MiB a session	One session	Each session	The network of the session ends, and the case says so at the top.	Nothing
Size of one download in a session	64 MiB a file	One file	Each file	The download ends at the limit, and the case says so at the top.	Nothing
Time of a session	15 minutes	One session	Each session	The session ends, and the case keeps the video and the report.	Nothing
Sessions running at once	3 sessions	Your organisation	When a session ends	livewells refuses the start and says that your organisation is already running its maximum number of sessions.	Nothing
Live sessions for a person	3 live sessions	One person	When the person ends a session	livewells refuses the start and says that you have too many live sessions.	Nothing
Starts in 15 minutes	10 starts	Your organisation	As starts leave the 15 minutes	livewells refuses the start and says how long to wait.	Nothing
Session starts in 15 minutes	5 starts	One person	As starts leave the 15 minutes	livewells refuses the start and says how long to wait.	Nothing
Starts refused in a minute	20 starts	Your organisation	After one minute	livewells refuses the start and says that too many starts were refused in the last minute.	Nothing
Live views of a session	5 views	One session	When a view closes	livewells refuses the new view.	Nothing
Data sent in a session	32 MiB	One session	Each session	livewells ends the network of the session.	Nothing
Files sent in a minute	10 files	Your organisation	After one minute	livewells answers `429` with a `Retry-After` header.	Nothing
Time for one case	3 minutes	One case	Each case	livewells skips the files it did not reach and marks them `case-timeout`.	Nothing
Time of one plugin run	30 seconds, 45 seconds for macro files, or 60 seconds for archive and office files	One file	Each file	livewells stops the plugin for that file and the file shows the error `plugin-timeout`.	Nothing
Size of one file	25 MiB a file	One file	Each file	livewells refuses the file, and the API answers `413` with the error `file-too-large`.	Nothing
Files in one archive	200 files	One file	Each file	livewells does not open the archive and the report says that the archive holds more than 200 files.	Nothing
Parts in one Office document	2,000 parts	One file	Each file	livewells does not read the document and the report shows that the file is larger or deeper than livewells reads.	Nothing
Captured files in a case	10 captured files	One case	Each case	The chain shows the file with the reason that livewells did not check it.	Nothing
Wait of a captured file for a free analysis slot	60 minutes	One captured file	Each file	The chain shows the file as queued and starts the analysis when a start leaves the 15 minutes. After 60 minutes the chain shows that livewells did not check the file because your organisation reached its limit of starts in 15 minutes.	Nothing
Retention of cases	7 to 365 days; the default is 90 days	Your organisation	Each case	livewells deletes the case and its files at the end of the period.	Nothing
Retention of security audit entries	At least 365 days	Your organisation	Each entry	livewells keeps the entry for that time, even when the retention of cases is shorter.	Nothing
Retention of IOC, blocklist and hunt export entries	Your organisation's retention period	Your organisation	Each entry	livewells removes the entry of each IOC, blocklist or hunt export when your retention period for cases has passed.	Nothing
Stored files	20 GiB	Your organisation	When you delete cases or retention ends	livewells does not store a new file and says that your organisation has used all of its file storage.	Nothing
API calls in a minute	60 calls	One key	After one minute	livewells answers `429` with a `Retry-After` header.	Nothing
Active API keys	20 keys	Your organisation	When you revoke a key	livewells refuses the new key and says that you have too many keys.	Nothing
Webhook endpoints	5 endpoints	Your organisation	When you remove an endpoint	livewells refuses the new endpoint and says that you have too many endpoints.	Nothing
Waiting runs	100 runs	Your organisation	When a run starts or expires	livewells answers `429` with the error `too-many-awaiting-runs`.	Nothing
Waiting runs for a key	25 runs	One key, or one person for runs queued from the link queue	When a run starts or expires	livewells answers `429` with the error `too-many-awaiting-runs`.	Nothing
Exports in a minute	10 exports	Your organisation	After one minute	livewells answers `429` and says that your organisation is downloading too fast.	Nothing
Video reads in a minute	120 reads	Your organisation	After one minute	livewells answers `429` and says that your organisation is downloading too fast.	Nothing
Sample downloads in an hour	60 downloads	One person or one key	At the start of the next hour	livewells answers `429` and says that this account has made too many sample downloads in the last hour.	Nothing
Reads in an hour	1,500 reads	One person or one key	At the start of the next hour	livewells answers `429` and says that this account has made too many reads in the last hour.	Nothing
Changes in an hour	300 changes	One person	At the start of the next hour	livewells answers `429` and says that this account has made too many changes in the last hour.	Nothing
Link previews in a minute	60 previews	Your organisation	After one minute	livewells answers `429` and says that your organisation previewed too many links in a minute.	Nothing
Keys made in an hour	30 keys	Your organisation	After one hour	livewells answers `429` and says that your organisation made too many keys in the last hour.	Nothing
Waiting runs cancelled in a minute	10 runs	Your organisation	After one minute	livewells answers `429` and says that your organisation cancelled too many runs in a minute.	Nothing

Network traffic

Network traffic is the data that the disposable browsers of your organisation move on the web, in both directions, in one UTC month.

A session holds up to the network limit of one session, 256 MiB, from the moment it starts. When the session ends, livewells replaces that figure with the traffic the session moved. Most sessions move a small part of it.
livewells refuses a start when the traffic of the month plus the 256 MiB that a new session holds is more than the limit. Near the limit, livewells can refuse a start while your organisation still has some traffic left.
A running session ends its network when the traffic of your organisation reaches the limit. The case shows the end at the top, and the video and the report stay.
A top-up adds traffic to the month. A top-up of 250 submissions adds 10 GiB.
Settings shows the traffic of the month against the limit under Usage.

Storage for a new session

The Usage view in Settings shows the stored files used against this limit.

A new browser session needs room for its evidence: 512 MiB for the recording and 16 MiB for each of the six other files. When your storage has less room, livewells refuses the start and says that your organisation has used all of its file storage.

Threat intelligence checks

A check of a domain costs 2 credits. A check of an IP address costs 1 credit. livewells counts a check at that cost when the answer comes from its store of earlier answers. See Enrichment.

Rates and waits

A source that makes more than 60 calls in a minute to the sign-in return step gets the answer 429 and a Retry-After header of 60 seconds.
Your organisation can run 2 file checks at once. A file waits in the queue until a check ends.
A file waits in the queue for 10 minutes at most. After that, the case ends.
Your organisation can start 20 checks of captured files in any 15 minutes.
Your organisation can send 10 file passwords in a minute. Above that, you get 429 and a Retry-After header of 60 seconds.
Your organisation can open 30 links from file reports in a minute, and one case allows 10. Above that, you get 429 and a Retry-After header of 60 seconds.
Enrichment for a case ends after 45 seconds. The case shows how many domains and addresses livewells did not check.

More about the limits

Submissions and top-ups: Billing.
Limits of the file types: Files.
Limits of the API: API.
Keys, endpoints and storage: Administering livewells.
Sessions: Cases.