Environment
- Carbon Black Cloud Console: All Versions
Question
Why can't Alerts API pagination be used to sort and fetch by last_update_time?
Answer
- Alerts API pagination is no longer supported when sorting and fetching by last_update_time because it is possible that some Alert data might be missed when last_update_time updates while performing consecutive API calls.
- Instead we recommend requesting the max rows of 10k. If you specify rows less than 10k while sorting by last_update_time then the API response will override and default to returning up to 10k results.
Additional Notes
- Additionally, be mindful that if
num_found is greater than 10k in the response, you will need to adjust the next fetch to start at the latest timestamp from your previous fetch to retrieve all alerts otherwise you’ll miss out on alerts in that time window. For more information see the following blog post. - Effective
October 20th, 2021: a default create_time time range of one month will be applied to _search, _facet, and workflow/_criteria when no time range specified. See blog for more details. - Alerts may take a few minutes to become available by API due to the asynchronous event processing. Consider delaying your search by 2-3 min or use the Data Forwarder for streaming behavior
Related Content
