Get Incident List from Microsoft 365 Defender

[E.Ok204121]

Hi Team,

I want to get the events between the dates I give from Microsoft 356 Defender. In the ‘microsoft-365-defender-incidents-list’ command, the limit is set to maximum 100. What should I do to make the limit unlimited?

The command:

test_data ={’$filter": “createdTime gt 2024-03-16T06:00:00.29Z and createdTime lt 2024-07-22T09:00:00.29Z”}
execute_command(‘microsoft-365-defender-incidents-list’, {‘status’: ‘Resolved’, ‘odata’:test_data})

In addition, I can send the current query according to the created time from the incoming data, but I want to learn if there is a known method such as limit=-1, not with a loop.

Best Regards,

#Microsoft365Defender Cortex XSOAR 

[cmcneil]

That's the neat part: you can't!

In the reference documentation for the 365 Defender integration, for the "incidents-list" command the default, and maximum, is 100.
You can change it to be less, but not more.
https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender#microsoft-365-defender-inci...