This page gathers what you can set for Security, and every limit its jobs work within. Each limit also appears on the page for its job.
Reasoning models stream their thinking for minutes before they answer, so a limit on a whole response would cut them off mid-thought. A platform admin sets three limits under Platform › Settings, on the Platform config tab, in the Models & inference group. Each is a whole number of seconds, and a change applies without a restart. See Settings.
| Setting |
Default |
Range |
What it bounds |
| Model silence limit |
300 |
30 to 3,600 |
A model call that sends nothing for this long is stopped: on the gateway, in agent runs and in the platform’s own calls, Security’s included. An answer that is still arriving is never stopped, so a reasoning model that streams its thinking is not cut. A call that does not stream sends nothing until it is done, so for it this is the limit that binds. |
| Model call limit |
1,800 |
60 to 14,400 |
The longest one model call may run through the gateway, for an application, an editor or an agent, and in Playground, Ask and assistants. |
| Security model call limit |
600 |
60 to 3,600 |
The longest one model call of a Security assessment, merge request review or investigation may run. Each job as a whole has its own, longer limit below. |
When an assessment’s batches fail with “the model did not answer”, or investigations end that way, with a reasoning model, raise the Security model call limit first, then the Model silence limit if the model is silent for long stretches.
| Rule |
Value |
| Size Olympusx AI treats as able to review code |
30B parameters or more, or any model from a connected provider. Smaller models can be chosen and are marked (may be too small to review code). |
| Which models can be chosen |
Any chat model the tenant can call: granted, and deployed and ready or served by a provider. |
| Who pays |
The model’s tokens count against the model’s budget and the tenant’s. A job checks the budget before it starts and before each batch or round. |
| Action |
Roles |
| Open the Security page |
Admin, Builder, Auditor |
| Read code findings, assessments and repositories; export SARIF |
Admin, Builder, Auditor |
| Start or stop an assessment; dismiss or reopen a finding |
Admin, Builder |
| Read investigations, hunts, log sources, log findings and proposed actions |
Admin, Auditor |
| Start an investigation; turn hunts on or off; add, test or remove log sources; turn alerts on or off; reject an action |
Admin |
| Approve an action that disables an account |
Admin (needs the right to manage people) |
| Set the model call limits |
Platform admin |
| Limit |
Value |
| Running assessments per repository |
1 |
| Files read per assessment |
3,000 |
| Code per batch |
About 24,000 characters (about 6,000 tokens) |
| Batches asked about at once |
2 |
| Findings per batch |
25 |
| Evidence lines per finding |
40 |
| A whole assessment |
6 hours |
| Progress silent before it counts as interrupted |
10 minutes |
| Assessments listed |
100 most recent |
| Tests and examples |
Not read unless Read tests and examples too is on |
| Limit |
Value |
| Patches kept per review |
1 MiB |
| Diff per model call |
About 24,000 characters |
| Calls per review |
20 |
| Comments per call |
15 |
| Reading and scanning a merge request |
10 minutes |
| A whole review |
1 hour |
| Posting a review |
2 minutes |
| Webhook delivery |
2 MiB |
| Reviews listed |
200 most recent |
| Limit |
Value |
| Rounds |
4 |
| Queries per round |
3 |
| Rows or events per query |
200 |
| Text shown to the model per round |
14,000 characters |
| Findings per verdict |
10 |
| Proposed actions per verdict |
3 |
| Evidence events per finding |
40 |
| Question |
2,000 characters |
| Window |
At most 90 days; 7 days by default; the console offers 1, 7, 30 and 90 days |
| A whole investigation |
30 minutes |
| Running before it counts as interrupted |
1 hour |
| Investigations listed |
200 most recent |
| Sigma rule draft |
8,000 characters |
| Limit |
Value |
| Preset hunts |
3 |
| How often Olympusx AI looks for due hunts |
Every 15 minutes |
| How often a hunt runs |
At most once every 24 hours |
| Window |
Since the last run; the last 24 hours on a first run or after 90 days |
| Limit |
Value |
| Kinds |
OpenSearch, Loki |
| Name |
80 characters, unique in the tenant |
| Mapped field name |
200 characters |
| Addresses refused |
Loopback, link-local, unspecified, multicast |
| One request to the store |
30 seconds; 10 seconds to connect |
| Answer read per request |
8 MiB |
| Redirects |
Not followed |
| Test on adding |
30 seconds |
| Limit |
Value |
| Alerts one delivery opens |
5 |
| Investigation window |
2 hours before the alert to 30 minutes after |
| Delivery body |
1 MiB |
| Secret |
32 random bytes, shown once |
| Limit |
Value |
| Findings listed |
500 most severe; the export takes them all |
| Dismissal reason |
Required; 1,000 characters |
| Severities |
Critical, High, Medium, Low, Information |
| Confidence (code) |
High, Medium, Low |
