| Category | What it means | What to do |
|---|---|---|
| Unauthorized | The provider rejected our credentials. | Reconnect the data source to refresh its credentials. |
| Rate limited | The provider rate-limited our queries. | Usually eases on its own. If it persists, raise the provider’s API rate limits or quota where possible. |
| Timeout | The query ran longer than our time limit and was cut off. | Eases as investigations learn to write faster queries. Scaling and improving performance of the data source can also help where possible. |
| Provider error | The provider’s own backend returned an error (a 5xx). The query itself was valid. | Usually transient. Check the provider’s status if it keeps happening. |
| Invalid query | The query we built wasn’t valid for this source, such as an unknown field or a filter that matched nothing. | This improves automatically as investigations learn your stack. Feel free to contact us if you have concerns. |
| Unknown | A failure we couldn’t categorize. | If you’re seeing a lot of these, reach out to support. |
Troubleshooting
Understand why a data source’s queries fail, and what you can do about it.
Each data source’s detail page breaks its failed queries down by category, so when a source has a low query success rate you can see why. Most categories are about the data source itself; a couple are things you can fix directly.