How to Increase Field Data Size Limit in FortiSOAR

[ranjeet]

Hi @Community ,

The default maximum data storage limit for FortiSOAR module fields is set to 10485761 as shown in below image, but our data exceeds this limit, causing our playbook step to fail.

We need to increase this limit, if anyone has a solution or workaround, please share your insights.

Thanks.

[akashj]

Hi @ranjeet ,
What is you use case , ideally we use the JSON field to store large volume of data and extract necessary values into a Textarea or text field for further use. 

[ranjeet]

Hi @akashj,

One of our customers has a source data field that contains more than 2000 associated events. When trying to update these events using the "Update Record" step, the process fails due to exceeding the maximum data size limit. To resolve this, I’m looking to increase the size limit of the source data field to handle the larger payload.

[akashj]

Thanks for providing the context.
Fetching 2000  associated events is not a good idea. the  associated events should be limited to max 10-15  and in worst case Top 50. if we add 2000 event it will be too much of non useful informationthat we are adding on soar side. I have not seen a use case were more that 10-50 events we required for investigation on SOAR. For further investigation they can directly do on siem.

i believe this size restriction is from database level and not from application.