TISC — Performance issues caused by high volume of URL observables related to the same domain<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Issue: Customers may experience performance issues in processing when a high volume of URL observables related to the same domain are ingested into TISC. This results in long execution times for sn_sec_tisc.process_corr_rule_delegated events and a large number of records accumulating in the Observable Potential Relationship table (sn_sec_tisc_m2m_observable_potential). Root Cause Analysis: The out-of-box TISC correlation rule "URL Observables with same domain" detects potential relationships among URL observables sharing the same domain. When a new URL observable is ingested, the rule extracts its domain and queries all existing URL observables with the same domain to create potential relationship records. The number of potential relationships grows exponentially with the number of URLs per domain. For example, 1,000 URLs sharing the same domain can generate up to ~500,000 records, and at 5,000 URLs this can exceed 12 million. As the table grows, each event takes longer to process, causing them to queue up in sysevent Temporary Fix: Role required: sn_sec_tisc.admin 1. Disable the correlation rule Navigate to the sn_sec_tisc_correlation_rules table in the classic UI.Find the record named "URL Observables with same domain".Set the Active flag to false and save. 2. Clean up the Observable Potential Relationship table Define a Table Cleaner (sys_auto_flush) record targeting sn_sec_tisc_m2m_observable_potential. This table stores possible relationships between library records created by correlation rules. These records can be safely cleared — removing them does not delete any actual observables or confirmed relationships. Note: If your are facing any issues with cleaning up of records in "sn_sec_tisc_m2m_observable_potential" table using table cleaner as suggested in the article, please reach out to customer support to truncate the table from backend 3. Error out the records in event queue table (sysevent) related to this correlation rule that are currently awaiting processing. To identify the records to be errored out (set state = error) please use the following filter on event queue table (sysevent) Name = sn_sec_tisc.process_corr_rule_delegatedParm2 = url_with_same_domainState is not one of "Processed, Error, Transferred" Permanent Fix: "URL Observables with same domain" correlation rule is disabled by default as part of TISC store release v4.3.0. The correlation rule "URL Observables with same domain" will be enhanced in upcoming TISC application version to not re-introduce the issue when customers enable the correlation rule in future.