Maximum total offenses reached

Explanation

By default, the process limit is 2500 active offenses and 100,000 overall offenses.

If an active offense does not receive an event update within 30 minutes, the offense status changes to dormant. If an event update occurs, a dormant offense can change to active. After five days, dormant offenses that do not have event updates change to inactive.

User response

Select one of the following options:

• Tune your system to reduce the number of events that generate offenses.
• Adjust the offense retention policy to an interval at which data retention can remove inactive offenses.

  To prevent a closed offense from being removed by your data retention policy, protect the closed offense.

• To free disk space for important active offenses, change offenses from active to dormant.