Is there a way to paginate get_detect_summaries?

[brucelourenco]

Hello community, I hope all of you are doing well.
I was searching for a solution, besides Event Stream, to get more than 1k of detections summaries from (GetDetectSummaries) and I couldn't find out an answer yet.
In the docus I could see the offset/limit parameters for (QueryDetects) but it does't exists for (GetDetectSummaries).
Could you guys give me some advice to achieve this?
Thank you!

[jshcodes]

Hi @brucelourenco -

GetDetectSummaries is not a composite endpoint, so it does not perform filtering or support parameters like offset and limit.

GetDetectSummaries supports up to 1,000 IDs per request. If the final list (after paginating using QueryDetects) is going to consistently exceed this, you might consider using something like concurrent.futures to speed up processing.

[jshcodes]

Here's a quick example. 😄

import logging
from concurrent.futures import ThreadPoolExecutor
from falconpy import Detects


def get_detects_details(detect_list: list):
    return falcon.get_detect_summaries(ids=detect_list)["body"]["resources"]

logging.basicConfig(level=logging.DEBUG)

falcon = Detects(debug=True)  # Pass client_id and client_secret if they are not in your environment

offset = 0
limit = 9999
detection_ids = []

while True:
    result = falcon.query_detects(offset=offset, limit=limit)["body"]
    total = result["meta"]["pagination"]["total"]
    offset = result["meta"]["pagination"]["offset"]
    detection_ids.extend(result["resources"])
    if len(detection_ids) >= total:
        break

print(f"{len(detection_ids)} total detections found")

batches = [detection_ids[i:i+1000] for i in range(0, len(detection_ids), 1000)]
details = []
with ThreadPoolExecutor() as executor:
    futures = {
        executor.submit(get_detects_details, batch) for batch in batches
    }
    for fut in futures:
        details.extend(fut.result())


print(f"{len(details)} total detections enriched")

[brucelourenco]

Hello @jshcodes ! Excellent!
Thanks a lot for your tips