topic Pull data from XDR through API in Cortex XDR Discussions

Pull data from XDR through API

Shashanksinha — Thu, 02 Feb 2023 18:36:55 GMT

Is there a limit to pull data from XDR through API?

I understand that query through API has limit but what if we are pulling endpoint information/alerts/incidents through it?

Re: Pull data from XDR through API

neelrohit — Tue, 07 Feb 2023 10:01:36 GMT

Hi @Shashanksinha ,

Thank you for writing to live community!

The maximum amount of incidents per API fetch cannot exceed 100.

Hope this helps! Please mark this response as "Accept as Solution" if it answers your query

Regards

Re: Pull data from XDR through API

etugriceri — Tue, 07 Feb 2023 10:05:15 GMT

There are additional two limits.

1 - Compute unit license. If you are executing heavy queries and consuming all of your Compute Unit license, You might not get data.
2 - General data availability of your data. If you dont have a retention license, with basic license, you can get max 6 months for incident/alert data and 30 days for endpoint related data.