Why can't Alerts API pagination be used to sort and fetch by last_update_time?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Why can't Alerts API pagination be used to sort and fetch by last_update_time?

Environment

• Carbon Black Cloud Console: All Versions

Resolution

• Alerts API pagination is no longer supported when sorting and fetching by last_update_time because it is possible that some Alert data might be missed when last_update_time updates while performing consecutive API calls.
• Instead we recommend requesting the max rows of 10k. If you specify rows less than 10k while sorting by last_update_time then the API response will override and default to returning up to 10k results. 

Additional Information

• Additionally, be mindful that if num_found is greater than 10k in the response, you will need to adjust the next fetch to start at the latest timestamp from your previous fetch to retrieve all alerts otherwise you’ll miss out on alerts in that time window. For more information see the following blog post.
• Effective October 20th, 2021: a default create_time time range of one month will be applied to _search, _facet, and workflow/_criteria when no time range specified. See blog for more details.
• Alerts may take a few minutes to become available by API due to the asynchronous event processing. Consider delaying your search by 2-3 min or use the Data Forwarder for streaming behavior
• Additional Information about bulk exporting alerts via the v7 API can be found here.