Limit Rates and Respect Quotas

[saadkadhi]

Request Type

Feature Request

Work Environment

NA

Problem Description

The current version of Cortex (1.0.0) does not support rate-limiting nor quota alerts for analyzers that rely on quota-based services.

This is a problem as analysts may consume the number of queries per time period (day/month...) or inadvertently cause abuse on free services by sending too many queries.

Possible Solutions

1. Implement configurable rate-limiting to limit the number of analyzer executions with respect to the available number of queries per time period (subscription level of the service) or the reasonable amount of queries for a free service.
2. Produce configurable quota alerts to alert analysts on the number of remaining queries past a certain threshold.

Complementary Information

The quota alerts should be shown in the Web UI next to each analyzer description and provided as a response to an API query (so that it can be displayed in TheHive).

TheHive should also have a page where analysts can view the query consumption per analyzer and how many are left without having to connect to the Cortex Web UI.