matanolabs / matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
https://matano.dev
Apache License 2.0
1.46k stars 99 forks source link

Expected Lambda Throttling Behavior and Performance Benchmarks #181

Open damon-edstrom opened 1 year ago

damon-edstrom commented 1 year ago

I noticed that there's consistent throttling of the IcebergMetadataWriterFunction (>100/5m) and LakeWriterAlertsFunction (>350/5m) lambdas and was wondering if this is expected behavior or if there's some tuning that should be done to increase the processing throughput of the lambda (e.g. increase RAM). The documentation states that there should only be one concurrent execution of the lambdas, I'm wondering in addition to if the throttling from this will cause issues, are there concerns about Matano scaling to be able to keep up with the increase in capacity? Are there any benchmarks or known throughput limits that you could share so we can ensure we don't overload Matano?