We identified and resolved the root cause of the increased rate of 502 errors on the API to be an increase in agents querying runreveal without effectively using the database indexes. Other endpoints were not affected.

We've done two things to address this issue:

• We're updating the logs query tool description to include instructions for how to query RunReveal in a way that better utilizes the indexes.

• We've changed the status code for query timeouts from 502 to 408 to indicate to the client that the query should be ajdusted to use an index.

We've received reports for an elevated rate of log query timeouts for RunReveal Cloud. We began to receive reports on Tuesday and immediately began investigating. We're opening this retroactively to indicate we're still working on a fix.

This should only be affecting queries done via the dashboard and via the AI chat or agent and it should not affect detection queries.

Data delivery has not been affected by this incident.