Get Incident List from Microsoft 365 Defender

E.Ok204121 — Wed, 24 Jul 2024 13:51:19 GMT

Hi Team,

I want to get the events between the dates I give from Microsoft 356 Defender. In the ‘microsoft-365-defender-incidents-list’ command, the limit is set to maximum 100. What should I do to make the limit unlimited?

The command:

test_data ={’$filter": “createdTime gt 2024-03-16T06:00:00.29Z and createdTime lt 2024-07-22T09:00:00.29Z”} execute_command(‘microsoft-365-defender-incidents-list’, {‘status’: ‘Resolved’, ‘odata’:test_data})

In addition, I can send the current query according to the created time from the incoming data, but I want to learn if there is a known method such as limit=-1, not with a loop.

Best Regards,

#Microsoft365Defender

Re: Get Incident List from Microsoft 365 Defender

cmcneil — Thu, 15 Aug 2024 22:48:04 GMT

That's the neat part: you can't!

In the reference documentation for the 365 Defender integration, for the "incidents-list" command the default, and maximum, is 100.
You can change it to be less, but not more.
https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender#microsoft-365-defender-incidents-list

topic Re: Get Incident List from Microsoft 365 Defender in Cortex XSOAR Discussions

Get Incident List from Microsoft 365 Defender

Re: Get Incident List from Microsoft 365 Defender