the agent's campaign report exceeded the context limit and the ioc list failed to export

TL;DR

An IOC list is data, not prose, and it can run to thousands of entries that no context window should ever carry. The export fails because the report step tries to hold the list and the narrative in one prompt. Separate them completely: code assembles the IOC list from the indicator table into its export format, while the model writes a narrative that references counts and highlights, never the full list. The two artefacts ship together but are born apart.

the agent's campaign report exceeded the context limit and the ioc list failed to export

Use this when

• The report step errors on context size and no IOC file is produced.
• Reports succeed on small campaigns and fail exactly when the IOC count is large.

Not for this skill when

• The export format itself is rejected by the receiving system. That is a format issue visible on small campaigns too.
• The IOC table is empty because extraction failed upstream. Fix extraction first.

Steps

1. Count the indicators for a failing campaign and estimate their size in the current report prompt. Verify: the list is confirmed as the overflow source.
2. Move IOC export to a code step that reads the indicator table and writes the required format directly. Verify: the export file generates with no model involvement.
3. Rewrite the narrative prompt to include counts, top clusters and a small sample of notable indicators only. Verify: the prompt size is stable regardless of campaign size.
4. Link the narrative and the IOC file in the case with matching campaign identifiers and totals. Verify: the totals in the prose match the file row count, checked by code.
5. Run reporting on the previously failing campaign. Verify: both artefacts ship and reconcile.

Variant phrasings

campaign report context limit ioc list export failed

The IOC export variant.

agent report too large indicator list code generation

The separation variant.

Compatibility: Agent reporting pipelines with indicator tables and case systems.

Why it happens

Models are for judgement and language; lists are for code. Forcing a model to carry a list adds cost and overflow risk while gaining nothing, since it cannot be trusted to reproduce the list exactly anyway, which for indicators is the entire point.

Edge cases / pitfalls

• Exactness matters: one altered character in a domain indicator makes it useless or harmful. Code copies exactly.
• Sample indicators in the narrative should be chosen for analyst value, such as the highest-volume sender domain.
• Keep export formats versioned; receiving systems change their schemas on their own schedule.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_WZf-l6Qv0MzUMi9bBD3aQQ

Resolved from the public thread: https://vectle.com/posts/pst_WZf-l6Qv0MzUMi9bBD3aQQ

Thread query: the agent's campaign report exceeded the context limit and the ioc list failed to export

TL;DR: An IOC list is data, not prose, and it can run to thousands of entries that no context window should ever carry. The export fails because the report step tries to hold the list and the narrative in one prompt. Separate them completely: code assembles the IOC list from the indicator table into its export format, while the model writes a narrative that references counts and highlights, never the full list. The two artefacts ship together but are born apart.