Understanding Consumption

Here you can find how we measure consumption depending on each one of our services.

⚠️

Group quota is shared between all group members. This means that for premium services, each individual user consumption is subtracted from the group quota. Therefore, it will be reflected in both the user and their group consumptions.

Summary table:

SERVICE / QUOTA CONSUMPTIONSearches / DownloadsAPI requestsLivehuntRetrohuntDiff SessionsPrivate Scanning FilesPrivate Scanning URLsASM EntitiesThreat ProfilesPrivate Graphs
APIXWhen using ASM API
Web searching and file downloadsXWhen using API 
LivehuntIf using Livehunt API endpointsX
RetrohuntIf using Retrohunt API endpointsX
DiffX
Private Scanning filesX
Private Scanning URLsX
ASM entitiesX
Threat profilesX
GraphWhen loading public graphsX

API

*Minute, daily and monthly limitations. E.g. requests/day

Quota consumption API details

Usually one API request consumes one unit from your quota. However, there are some exceptions:

  • Checking consumption and quota details: Endpoints to check consumption or quota details such as /users/{id}/overall\_quotas or /users/{id}/api\_usage won't consume any API quota from your license.
  • Feeds: No quota consumption for feeds endpoints. This includes file downloads using links provided by feeds endpoints.
  • Uploading new files: If a user uploads a new file that is not present in Google TI, no API quota will be consumed from their license. Further calls to retrieve this file's data (GET/files/{sha256}) won't consume quota either. Note that re-scanning the file (POST/files/{sha256}/analyse) will consume quota as any other API call.
  • ASM API endpoints: ASM endpoints won't consume API quota from your license, those requests will consume from your ASM entities quota.

Link to our API documentation

Web searching and file downloads

*Monthly limitation. E.g. downloads/month

Quota consumption searches and downloads details

Web searching and file downloads quotas are always consumed via UI.

  • 1 unit from your Searches quota will be consumed by any of these operations: direct search to get an IoC report, pivoting to another search or using pagination to get more results after an advance search.
  • 1 unit from your File Downloads quota will be consumed by any file download made through Google Threat Intelligence's UI.

⚠️

If you perform searches or downloads via API, those requests will consume from your API quota

Hunting

*Monthly limitation. E.g. rules/month

Quota consumption Hunting details

Livehunt


Each active YARA rule you create consumes 1 unit from your quota (inactive rulesets won't consume any quota). This means that if you have 3 rules in 1 active ruleset, you will consume 3 YARA rules from your Livehunt quota.

Retrohunt


Each retrohunt job you create consumes 1 unit from your quota, no exceptions. This means that it doesn't matter if your job was successful or not or whether it had matches or not.

Diff

*Monthly limitation. Diff sessions/month

Quota consumption Diff details

Each diff session you create consumes 1 unit from your quota.

Private Scanning

*Monthly limitation. Private files uploaded/month

Quota consumption Private Scanning details

Private Scanning files


Each file submitted consumes 1 unit from your quota of Private Scanning files.

Private Scanning URLs


Each URL submitted consumes 1 unit from your quota of Private Scanning URLs.

ASM entities

*Monthly limitation. ASM entities/month

Quota consumption ASM Entities details

Each ASM entity discovered on any of your ASM projects will consume 1 unit from your quota of ASM entities.

Threat Profiles

*Monthly limitation. Threat Profiles/month

Quota consumption Threat Profile details

Each threat profile created will consume 1 unit from your Threat Profiles quota.

Graph

*Monthly limitation. Private graphs/month

Quota consumption Graph details

Premium


Graph service only consumes from graph quota when creating private graphs.

If you create a private graph, it will consume 1 unit from your quota. No other consumption will be applied.

Public


However, creating a public graph will consume your API quota based on the API requests required to load all items. The more items you load, the more API requests will be made, and consequently, the more API quota will be used.