Slow get_alerts API response / Validity check

[moradiya]

Hi all,

I’m integrating Cortex XDR APIs and want to validate the get_alerts endpoint for connectivity and credentials.

I’ve already tested the get_incidents endpoint, and it works fine with our API keys.

When I call get_alerts, it always takes ~50 seconds to respond, even with minimal filters (e.g., creation_time >= current_time) and small result limits.

I have some upper-level checks in my system that expect API responses to return within 25 seconds for testing the connection. If the API call takes longer, it triggers an error. This is exactly what happens with get_alerts.

My questions:

• Is this long response time expected behavior for get_alerts?
• Is there a recommended way to verify that get_alerts is valid and working without waiting for a full 50-second query?
• Are there best practices for performing a lightweight health-check on get_alerts specifically?

Any guidance, examples, or workarounds would be greatly appreciated.

[eluis]

Hi @moradiya 

Answering to your questions: 

Typically API queries depend on the complexity of the script you write and the type of query being run. And very important too, the network speed at your end. 

Then, there is no defined time under which the API should run and return results.

There are no best practices defined by us on running rest APIs since as said before, the execution is very flexible depending on the type of query being run, data pulled, network speed.... etc 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis