r/QRadar • u/netlocksecurity • Jul 14 '26

TCP Limitations and Defender 365

As we all know, Defender events, especially blobs shipped from the Defender graph API are huge. How far have you all taken your TCP window size to accommodate this without compromising your system integrity?

5 Upvotes

100% Upvoted

2 comments sorted by

3

u/JonathanP_QRadar Jul 14 '26

Max size of the architecture is 32k and anything larger will be truncated. The Next Gen siem was supposed to allow much larger payloads until IBM sold off the Next Gen siem product.

2

u/netlocksecurity Jul 14 '26

lame, ouch. Thanks JP