Case Management
Case Management Limitations
Analyst Copilot
| Feature | Description | Limit | Notes |
|---|---|---|---|
| Ability Workflow’s Output | Maximum output size of an ability workflow’s Output | 100Kb | The output of an ability workflow is restricted to a maximum size of 100 KB. This limitation exists because the workflow’s output is used as the input for the subsequent LLM call. Enforcing this cap ensures stability, reliability, and compatibility across workflow executions. |
| Copilot Session Context Window | Maximum size of the conversation sent to Analyst Copilot in a single session. | 2MB | The Analyst Copilot retains a maximum of 2 MB of conversation context per session. If the session exceeds this limit, the earliest messages (the initial messages sent to the analyst copilot), are removed from the active context. Only the most recent messages within the 2 MB window remain available for reference and processing. |
Tables
These limitations apply to all tables within Case Management:- The Cases Table
- The Alerts Table
- The Observables Table
- The Attachments Table
- The Tasks Table
- Custom Tables
| Feature | Description | Limit |
|---|---|---|
| Tables | Maximum number of tables per workspace. | 100 |
| Columns per table | Maximum columns allowed per table. | 100 |
| Records per table | Maximum records (entries) allowed in a table. | 1,000,000 |
| Field value size | Maximum size of the value that can be stored in a single field value | 40KB |
| Long text field | Maximum number of characters that can be entered into the Long Text input field. | 5MB (equivalent to 5,242,880 characters) |
| Multi-Select field | Maximum amount of options allowed to be added to multi-select field. | 32 |
| SQL Query result size | Maximum size of results returned by an SQL query action. | 5MB |
| Query page size | The maximum number of results that can be retrieved from a table when using the Query action. | 1,000 |
| SQL Query time limit | Maximum execution time for an SQL query action to run. | 30s |
Alerts and Single Alert SLA
Disclaimer: Blink can process hundreds of alerts per minute without performance degradation. However, performance may vary depending on your workflow design. In case limits are exceeded, latency may occur during the Alerts Ingestion and Alerts Processing processes. Rest assured, no data will be lost.
| Limit Description | Limit Value |
|---|---|
| Alert Ingestion | Up to 1s per alert. |
| Maximum Alerts Ingested at Once | The number of alerts that can be ingested at once depends on how your ingestion workflows are configured. The standard workflow limits apply to all Alert Ingestion Workflows. |
| Alerts Processing |
|
| Maximum Alerts Processed per Minute | 100 alerts/min (e.g., 2000 alerts will take 20 min). |
Observables
| Limit Description | Limit Value | |
|---|---|---|
| Observables | 100 | The maximum amount of observables per workspace |
Case Timeline and Overview
| Feature | Description | Limit Value |
|---|---|---|
| Timeline Comment Limit | Maximum size for a single comment on the Case Timeline. | 64KB(equivalent to 65,536 characters) |
| Notes Section in Case Overview | You can add notes to a case overview, up to a maximum size of 500 MB. | 500 MB |
| Attachment Size Limit | Maximum size for file attachments in Case Management, Case Timeline or in the Notes section. | 10GiB (Gibibytes) |
| Attachment Storage Limit (per tenant) | Total size limit of all attachments in a tenant’s case management | 1TB (Terabyte) |
| Batch File Attachments | Maximum number of attachments you can add to the Case Timeline at once. | 10 |