For large deployments or slower networks, CrowdStrike update throttling lets you control the rate at which sensor updates and channel file downloads occur. This prevents updates from consuming excessive bandwidth while ensuring hosts stay protected.
Understanding Update Throttling
CrowdStrike provides two types of throttling:
| Type | What It Controls | Default |
|---|---|---|
| Sensor Update Throttling | Number of sensors updated per minute | 50 sensors/minute |
| Channel File Throttling | Bandwidth for policy/config updates | No limit (unthrottled) |
Sensor Update Throttling
Sensor update throttling controls how many hosts begin their sensor update per minute.
How It Works
- Updates are pushed to sensors each minute based on your limit
- Even if the first batch hasn't completed, the next batch starts
- Actual throughput depends on network conditions
Example Timeline
With 50 sensors/minute rate and 1000mbps bandwidth:
- 1000 sensors: ~20 minutes to complete
- 5000 sensors: ~100 minutes (1 hour 40 minutes)
Adjusting Sensor Update Rate
- Go to Support and Resources > Resources and Tools > General Settings
- Click Throttle Updates
- Use the Sensor update rate menu to select hosts per minute
- Click Save
Recommendation: Make incremental changes (one step up or down), test the impact on network performance, then adjust further if needed.
Channel File Update Throttling
Channel file updates push dynamic content from the cloud to sensors:
- Policy updates
- Configuration settings
- Detection content
File Size Considerations
Channel files typically range from 1KB to 2MB. For large environments:
| Sensors | File Size | Total Download |
|---|---|---|
| 10,000 | 2MB | 20GB |
| 50,000 | 2MB | 100GB |
| 100,000 | 2MB | 200GB |
Adjusting Channel File Bandwidth
-
Go to Support and Resources > Resources and Tools > General Settings
-
Click Throttle Updates
-
Use the Channel file bandwidth limits menu to set limits:
-
Per second
-
Per minute
-
Per hour
-
Per day
-
Click Save
Tip: To clear a throttling setting, delete the value.
How Throttling Is Applied
When multiple limits are set, the most restrictive size and rate combination is enforced. For example:
- 100MB per hour AND 1GB per day
- Both limits apply, whichever is reached first
When to Adjust Throttling
Decrease Rate When:
- Network bandwidth is limited or shared
- Updates are causing network congestion
- Remote sites have slow WAN links
- Users are reporting network slowdowns during updates
Increase Rate When:
- Updates are taking too long to complete
- You have ample network bandwidth
- Security updates need rapid deployment
- Off-hours update windows are limited
Combining Throttling with Update Exclusions
When using both throttling and update exclusions, ensure you allow adequate time for all hosts to receive updates:
- Restrictive exclusions + Low throttle rate = Some hosts may never update
- Calculate total update time needed: (Total hosts ÷ Rate per minute) = Minutes needed
- Ensure non-excluded hours exceed the time needed
Throttling Settings Location
All throttling settings are configured in one location:
Support and Resources > Resources and Tools > General Settings > Throttle UpdatesSettings available:
-
Sensor update rate: Hosts per minute
-
Channel file bandwidth limits:
-
Per second
-
Per minute
-
Per hour
-
Per day
Best Practices
- Start small: Make incremental changes and observe impact
- Test first: Validate settings in a test environment or during off-hours
- Monitor network: Watch network utilization during update periods
- Calculate needs: Understand your sensor count and bandwidth capacity
- Balance speed and impact: Faster updates mean more bandwidth; slower updates take longer
- Consider remote sites: Remote locations may need lower rates