EDR: Unpaged request has "x" results, exceeds limit of 1000. Please consider using paging.
book
Article ID: 284947
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)Carbon Black Hosted EDR (formerly Cb Response Cloud)
Issue/Introduction
When attempting to use the API to query greater than 1000 sensors an error is encountered. These errors can be encountered via the UI, RestAPI and Python API.
Some users have reported seeing this message while using the Python API:
'{"message":"Unpaged request has <num> results, exceeds limit of 1000. Please consider using paging."}'
Environment
EDR: 7.6.0 +
Cause
CB-36843 which was remedied in EDR 7.6.0 included a defect fix that implemented a new parameter into the /etc/cb/cb.conf file:
By default this is set to '1000'. Previously it was non-existent.
Resolution
For CBAPI:
Please upgrade to cbapi 1.7.6 to take advantage of the pagination. No adjustments needed to your script as cbapi will do the pagination. All Products: How to Update CbAPI
For Console export:
Add the following settings to a value higher than is returned by the unpaged request