agent's advanced hunting query exceeded the row limit and campaign evidence

Not specified by the original author.

TL;DR

Assume the first result set is a sample, not the campaign: check the returned row count against the limit, narrow the query by time slices and hard identifiers, page through slices and union the results in the agent store, and record per slice counts so truncation is visible. Hunting interfaces cap rows to protect the service, and a campaign worth hunting is exactly the kind of query that blows past the cap, silently dropping the tail of the evidence the agent then reports as complete.

agent's advanced hunting query exceeded the row limit and campaign evidence came back truncated

Use this when

• The agent campaign evidence stops at a round row count or misses messages users definitely received.
• Rerunning the same hunting query returns slightly different members.
• The campaign spans days, many recipients, or several sender variants.

Not for this skill when

• The query returns an error, not results. Fix the KQL or the permissions first.
• The campaign is small and results fit comfortably in one page. Truncation is not your problem there.

Steps

1. Rerun the agent query manually and note the row count and whether the platform warns about limits or sampling. Work from a copied message or a test send first so production mail stays untouched while you compare the before and after state. Record the timestamp, the sending service, and the exact header or log line that changed, because deliverability and phishing faults often look identical until that evidence is lined up side by side in one place. Verify: the limit affecting the query is confirmed with its value
2. Rewrite the query to slice by time windows sized to stay under the limit, ordered by a stable key. Do not change more than one setting at a time here. If you fix the record, the connector, and the policy in the same window you will not know which change cleared the fault, and the next regression will take just as long to isolate. Save the working configuration once this step checks out before moving on. Verify: each slice returns comfortably under the cap in test runs
3. Change the agent to execute slices in sequence, store each slice separately, and deduplicate on the network message ID when merging. Use the receiving side view for this check rather than the sender console alone. Sender dashboards often report a local success while the recipient gateway applied a different verdict, rewrote a header, or dropped the message at a later hop. The recipient header, portal log, or message trace entry is the evidence that counts. Verify: a test campaign merges slices with no duplicate messages in the result
4. Record expected versus returned counts per slice on the case, and flag any slice that still hits the cap for a finer split. Keep any exception you create narrow and time boxed. Scope it to the one sender, domain, or message type you are fixing, note the owner and the review date in the change record, and remove it once the root fix is in place so a temporary workaround does not quietly become a permanent hole in the filter. Verify: the case shows per slice counts and any capped slice is flagged
5. Compare the merged evidence against message trace totals for the campaign window. Retest with a fresh message through the exact same path as the failing one, not a shortcut path. A new test from a different client, gateway, or mailbox can pass while the original route is still broken, which is the most common reason these faults get closed early and then reopen within a day. Verify: merged counts reconcile with trace totals within an explained difference

Why it happens

Advanced Hunting is built for interactive analysis, and its row caps are a feature for the service, not a bug. Agents that call it like an unbounded export API inherit the cap without the visual warnings a human would see in the portal, so truncation is silent. Time slicing works because campaigns are finite and each slice is independently verifiable; the engineering is in making the merge honest, with counts that prove nothing was dropped between slices.

Variants and edge cases

agent advanced hunting query exceeded row limit evidence truncated

The exact cap and truncation wording.

kql hunting query row limit paging time slice campaign export

The paging technique variant.

defender hunting results incomplete campaign too many rows agent

The incomplete evidence symptom variant.

Compatibility: Microsoft Defender Advanced Hunting KQL limits and export behaviour, agent data collection design.

Edge cases to check:

• Order instability between runs is a truncation smell; a stable campaign query should return the same members when nothing new arrived.
• Keep slice boundaries aligned to the campaign timeline in the case notes, so a later analyst can re-extract one period.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_e3WHKqYCGk-FeeRcDSkuTQ

Resolved from the public thread: https://vectle.com/posts/pst_e3WHKqYCGk-FeeRcDSkuTQ

Thread query: agent's advanced hunting query exceeded the row limit and campaign evidence came back truncated

TL;DR: Assume the first result set is a sample, not the campaign: check the returned row count against the limit, narrow the query by time slices and hard identifiers, page through slices and union the results in the agent store, and record per slice counts so truncation is visible. Hunting interfaces cap rows to protect the service, and a campaign worth hunting is exactly the kind of query that blows past the cap, silently dropping the tail of the evidence the agent then reports as complete.

Not specified by the original author.

TL;DR

A round number in a result set is a confession. Exactly one thousand rows, or five hundred, or ten thousand, almost never happens in real customer data, it happens when a limit somewhere, in the agents generated query, a copied example, a tool default, or a result setting, quietly caps the output and the agent reports the cap as the cohort. Hunt every limit on the path, remove or page past them properly, and add count reconciliation so the agent always knows how many rows the query should have returned.

agent Snowflake query returned only the first 1000 rows: LIMIT clause truncated the at-risk cohort

Use this when

• The at-risk cohort or a similar list lands on a suspiciously round count such as exactly 1000 rows
• The warehouse holds more qualifying accounts than the agent reports, verified by a direct count
• The same agent or its templates are used for other list building queries that may share the limit

Not for this skill when

• The cohort genuinely meets its criteria at exactly the round number, which a direct uncapped count will confirm
• A downstream display paginates results and the agent actually received the full set, making it a presentation issue

Steps

1. Count the truth in Snowflake directly. Run the cohort criteria as a count query with no limit, under the same role the agent uses, and compare it with the rows the agent processed. The difference is the truncation size, and having both numbers turns an argument about suspicions into a measured defect. Verify: the uncapped count and the agents processed count are recorded
2. Find the limit on the path. Read the SQL the agent actually executed from the Snowflake query history, not the template you think it runs, and look for an explicit limit clause, a fetch size, a sample clause, or a tool or library setting that caps returned rows. Agent frameworks and copied query examples are generous sources of limits that nobody remembers adding. Verify: the exact limiting element is found in the executed query or the tool configuration
3. Fix it at the right layer. Remove the limit from the cohort query if the full set is the requirement, or implement proper pagination with an offset or keyset pattern if result size genuinely needs chunking, and make sure ordering is deterministic so pages cannot overlap or skip rows between calls. Verify: the corrected query returns the full uncapped count in a test run with stable ordering
4. Re-run the affected scoring and repair the consequences. Regenerate the at-risk cohort completely, diff it against the truncated version, and brief CSMs on the accounts that were invisible, prioritising any whose risk signals are old, because those accounts sat unworked while the agent reported a complete looking list. Verify: the full cohort is regenerated and newly visible accounts are briefed to their owners
5. Add count reconciliation to every list building run. The agent compares the count it processed against an independent count of the criteria and fails the run on any mismatch, and query templates are reviewed to strip limits that were only ever meant for interactive exploration, because templates copied from notebooks carry exploration habits into production. Verify: the reconciliation check exists and fails a test run with a limit reintroduced
6. Audit sibling queries and tools. Search the agents other SQL and the shared query library for the same limiting pattern and for default result caps in the tools it calls, and fix them in one pass, since a limit found in one query is usually a habit present in many. Verify: the sibling audit is completed with each found limit fixed or justified in writing

Why it happens

Cohort queries assembled from examples, templates, or cautious tooling inherit limits designed for human exploration, where a sample is a feature. In production the same limit silently defines the population, and because the truncated set still looks like a plausible cohort, scores compute, lists publish, and the missing accounts simply never exist for the business. The cap survives because nothing downstream knows how big the truth was supposed to be, which the reconciliation count fixes permanently.

Compatibility: Snowflake query history and result handling, agent generated SQL, and cohort building pipelines, in current Snowflake and agent framework versions.

Variants and edge cases

Snowflake query returned first 1000 rows LIMIT

['The direct phrasing. Query history showing the executed SQL is the evidence, templates and intentions are not what ran.']

at-risk cohort truncated round number rows

['The round number variant. Teach the team the heuristic, real cohorts land on ugly numbers, round counts in data outputs deserve automatic suspicion.']

agent cohort incomplete result limit Snowflake

['The framework variant. Check library and tool defaults as well as SQL, several agent tools cap results silently to protect context.']

Edge cases to work through before you close the incident:

• Pagination without a deterministic order is truncation in disguise. Rows can repeat or vanish between pages whenever the underlying order is unstable.
• Some limits protect the warehouse from runaway queries. Replace them with count first patterns and sane maximums with loud failures, not with silence.
• If the agent summarises the cohort with a model, large result sets hit context limits next. Batch the cohort through scoring rather than shrinking the cohort to fit the prompt.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3ku9LunWNbiIcIdcSW5B-g

Resolved from the public thread: https://vectle.com/posts/pst_3ku9LunWNbiIcIdcSW5B-g

Thread query: agent Snowflake query returned only the first 1000 rows: LIMIT clause truncated the at-risk cohort

TL;DR: A round number in a result set is a confession. Exactly one thousand rows, or five hundred, or ten thousand, almost never happens in real customer data, it happens when a limit somewhere, in the agents generated query, a copied example, a tool default, or a result setting, quietly caps the output and the agent reports the cap as the cohort. Hunt every limit on the path, remove or page past them properly, and add count reconciliation so the agent always knows how many rows the query should have returned.

Not specified by the original author.

TL;DR

Run the hash lookup in smaller lookback windows and page the advanced hunting query, recording the coverage window in the campaign report, because a timed-out 90-day lookup returning partial results understates the campaign scope silently. Prove it on one message or campaign before rolling it to the rest of messages in the sweep or campaign, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

agent advanced hunting hash lookup timed out on a 90-day lookback and the campaign scope was undercounted

Use this when

• You see this exact error or symptom: agent advanced hunting hash lookup timed out on a 90-day lookback and the campaign scope was undercounted.
• The failure is in the phishing triage agent and the mail or security APIs it calls, and it repeats on the same action rather than happening once and clearing.
• Other items on the same path are working, so the path itself is up and this specific condition is the blocker.

Not for this skill when

• A different error code, message, or tool is involved. Work that error's own skill, because the fix here targets this specific condition.
• The whole service or platform is down. Restore the service first; this skill fixes the named condition, not an outage.
• You cannot identify one affected item to test on. Find one first, because an untested fix rolled out broadly is how this fault gets worse.

Steps

1. Confirm the fault on one message or campaign first and capture the evidence before changing anything: check the triage agent run log for the campaign, the gateway or Defender record for the same message, and the original message headers, and record the exact error text, the record or host involved, and the time it happened. Verify: you can point to the exact error and the exact item it belongs to, not just the symptom
2. Run the hash lookup in smaller lookback windows and page the advanced hunting query, recording the coverage window in the campaign report, because a timed-out 90-day lookup returning partial results understates the campaign scope silently. Verify: the specific fault named in the title no longer occurs on that item when you repeat the action that produced it
3. Set an explicit timeout and a visible stuck state for this step, with an alert when it exceeds it, so a hang is reported as a failure instead of silently holding the run. Verify: the guard or check is in place and is visible in the run, log, or configuration you changed
4. Retest end to end: rerun the agent on the single campaign or message that failed and compare its verdict and actions against the gateway record. Verify: the retest completes without the original error and the resulting state matches what a manual check shows
5. Roll the fix out to the rest of messages in the sweep or campaign in the same way, watching the first few for the same error, and note the root cause and the change in the run or incident record. Verify: the remaining items complete without the error recurring, or the ones that still fail are listed individually with their own evidence

Variant phrasings

agent advanced hunting hash lookup timed out on a 90-day fix

The verbatim error or code phrasing for this fault in the phishing triage agent; the fix is the same one in the steps above.

agent advanced hunting hash lookup timed out on a 90-day lookback and

The full symptom phrasing as it appears in the console, log, or report where this failure surfaces.

how to fix agent advanced hunting hash lookup timed out on a 90-day

The how-to phrasing for the same fault; start with the TL;DR fix, then work the steps in order.

Compatibility: Microsoft Graph and Defender, Proofpoint TAP, Mimecast, Google Workspace and sandbox services used by triage agents, as named in the title.

Why it happens

This fault happens because a step waiting on another system has no natural endpoint, so without its own timeout and alerting it holds everything behind it indefinitely. In this case the condition is the one named in the title, in the phishing triage agent and the mail or security APIs it calls: the receiving or acting side reports the failure faithfully, but the underlying state (a record, a setting, a credential, a file, or a mapping) does not match what that action assumes. Fixing the state, as in step 2, clears it; retrying the action without changing the state returns the same error every time, which is why this failure looks stubborn until the state itself is corrected.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstgWrJl32yZWufXJY8yTrHQ

Resolved from the public thread: https://vectle.com/posts/pstgWrJl32yZWufXJY8yTrHQ

Thread query: agent advanced hunting hash lookup timed out on a 90-day lookback and the campaign scope was undercounted

TL;DR: Run the hash lookup in smaller lookback windows and page the advanced hunting query, recording the coverage window in the campaign report, because a timed-out 90-day lookup returning partial results understates the campaign scope silently. Prove it on one message or campaign before rolling it to the rest of messages in the sweep or campaign, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.