Carbon Black Cloud: Getting "Internal Server Error" While Attempting to Run the Device API Script on More Than 200K Machines

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Getting the below error while running the API Script on more than 200k Endpoints.
 

cbc_sdk.errors.ServerError: Received Error code 500 from API : {"Success": False, "message": "Internal server error"}

 

Environment

• Carbon Black Cloud Console: All Supported Versions
• Linux: All Supported Versions

Cause

The issue is due to the hardcoded limit of 200K endpoints for the Device API query.

Resolution

• Our Engineering team is currently working on extending the Device API query limit
• This article will be updated soon once when the resolution is available
• The Current Workaround is to limiting the API query to certain batch of machines that does not exceeds the limit.

Example Query: 

cb_api = CBCloudAPI(url=url, token=tkn, org_key=org)
batch = list(cb_api.select(Device).set_max_rows(10000))
devices.extend(batch)
print(len(devices))