Skip to content

Commit

Permalink
Inability to fetch "all" incidents, only 50 (#565)
Browse files Browse the repository at this point in the history
As far as I can tell, as of latest commit, d87b394 of sentinel_core.py, only 50 incidents are returned. 

The current implementation does not seem to respect the `nextLink` returned by the API and thus does not seem to paginate over incidents. 

Perhaps an issue in the msticpy repo would be better suited for this report.
  • Loading branch information
pensivepaddle committed Nov 11, 2022
1 parent b1b6c9e commit d29a791
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions docs/source/data_acquisition/SentinelIncidents.rst
Expand Up @@ -4,7 +4,7 @@ Microsoft Sentinel Incidents
List Incidents
--------------

It is possible to return a list of all incidents within a workspace, as well as get the details of a specific incident.
It is possible to return a list incidents within a workspace, as well as get the details of a specific incident.
Whilst it is possible to access these incident details via the Incident table in the Workspace, you can also interact
with them via the Microsoft Sentinel APIs which are utilized in these functions.

Expand All @@ -14,7 +14,7 @@ See :py:meth:`get_incidents <msticpy.context.azure_sentinel.MicrosoftSentinel.li
azs.list_incidents()
This returns a DataFrame with details of all incidents.
This returns a DataFrame with details of incidents.

To get details of a single incident you can call `.get_incident` and pass the ID of an incident.
This ID can be found in the name column of the DataFrame returned by `.get_incidents` and appears in the form of a GUID.
Expand Down Expand Up @@ -99,4 +99,4 @@ See :py:meth:`create_incident <msticpy.context.azure.sentinel_core.MicrosoftSent
azs.create_incident(title="A custom incident", severity="High"
)
)

0 comments on commit d29a791

Please sign in to comment.