Troubleshooting Collection Issues

How to resume paused Collections

If a collection exceeds the maximum size, it will pause. In this state, collection membership (i.e., assets in the collection) is frozen, and users can't view, query, or return results for assets in the collection. Webhooks and alert settings are preserved, but because membership is frozen, no new events are generated. Collections paused for more than 90 days are automatically archived.

📘

Note

When a collection becomes unpaused, expect some event drift as the collection membership updates to reflect the current state of the world.

Resolve paused Collections caused by size limits

Collections hold a maximum of 10,000 assets. When a collection reaches 9,500 assets, collection editors and organization administrators are notified via email that the collection is approaching its maximum size.

Reduce Collection Size

Refining the collection query to narrow its scope can restore a paused collection.

👍

Tip

When refining a collection query to produce fewer results, consider refining location, protocols, software, or other vulnerabilities to narrow the scope of the assets being monitored.

1. Go to Collections.
2. Click on the collection with the Max Size Exceeded Error.
3. Refine the query to limit the results in the collection.
4. Go to the Settings tab and use the Size Estimator to view the query size.
5. Click Update.

Resolve paused Collections caused by invalid queries

Collections with invalid queries are automatically paused. Users cannot create collections with invalid queries, but existing collections may become invalid if the underlying dataset becomes inaccessible. This typically occurs when a dataset subscription lapses. Queries become invalid if they reference fields from an inaccessible dataset.

Adjust your Collection query

1. Go to Collections.
2. Click on the Collection with the Invalid Query Error.
3. Remove references to unentitled fields from the collection query.
4. Click Update.