Increase Timeout on UDM Query Action

[jasonsigman]

Trying to perform a 30 day search for a list of IOC's found in a Reference list using this query. I can run this in the UI but trying to run it via SOAR gives me error below any tips?

(ip IN %TH_Requested_IOC_Hunts OR hash IN %TH_Requested_IOC_Hunts) AND metadata.vendor_name != "Palo Alto Networks"

Error executing action Google Chronicle - Execute UDM Query. Reason: HTTPSConnectionPool(host='backstory.googleapis.com', port=443): Read timed out. (read timeout=120)

[ylandovskyy]

Hey @jasonsigman,

My suggestion would be to split the execution in 2 parts using the custom Time Frame option. So, you would split the search into 2 15 Day searches.

In the meantime, I will check internally with the team. This action is sync, so the timeout for it at max can reach 5 minutes. It looks like currently it stops execution after 2 minutes.

[jasonsigman]

Thanks I will split it up for now. I was wondering why it felt like it stopped a lot sooner then expected. I am just worried about hitting the limit of 120 queries once we have this running on cases/alerts coming into the platform.