Hi @brownchris your analysis is correct. By default, the query returns 100 results. This is explained in the API description page.
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-manageme...
Now as we look further down the page, we notice the details of a successful response. It contains three fields:
Assuming you need to retrieve 160 incidents (i.e., more than 100), you'll need to make 2 calls at a minimum. The first call will retrieve the first 100 results, the next one will retrieve the remaining 60 results. This is how the response will look like:
First call
total_count = 160
result_count = 100
incidents = {[100 incidents]}
Second call
total_count = 160
result_count = 60
incidents = {[60 incidents]}
The way to do that is by modifying the search_from and search_to fields in the request_data parameter in successive calls. This will return the results corresponding to the offsets that you're requesting for.
Here is an example for retrieving larger datasets using the get_endpoints API. I have used Python as the scripting language, but you can use any language/script or querying tool that can make POST calls.
Here, you can see the total_count value as 113, and the result_count value as 12. The way I am able to retrieve those specific entries is by changing the values of the search_from and search_to fields. As this is an example, I have hard-coded the values. In your case, you should programmatically change the values of the two fields by incrementing the values accordingly using counters and loops.
Let us know how it goes.
Thank you @bbarmanroy, really appreciate your response. The challenge I am finding PowerBI doesn't like when I declare the search parameters. I get a bad request error when I attempt to add the "search_from" & "search_to" parameters.
