Restrictions to prevent resource-intensive searches

You can balance the usage of your QRadar infrastructure by setting resource restrictions on IBM® QRadar event and flow searches.

Before you set resource restrictions, carefully consider the normal operational procedures in your environment. Try to set restrictions that ensure that all users have access to the data that they require, yet prevent them from inadvertently running large queries that negatively impact the system availability and performance for other users.