Skip to main content
McAfee MVISION Cloud

Managing API Responses

 

The Incidents API returns 10,000 incidents per call; responses are based on the start time of incidents. To ensure that incidents with identical start times are not split into two API responses, the Incidents API includes any subsequent incidents that have the same start times as the 10,000th incident. 

In each call, there is a responseInfo object returned along with the incidents, which includes a field with the next start time. This next start time continues the query.

For example, let's say we want a query with starttime=a and endtime=b. This query would return 100,000 incidents for the defined duration. MVISION Cloud sends the first 10,000 incidents with starttime=a. The nextstarttime is included in the response (as there is more data in the <a,b> duration interval). To get the rest of the incidents, we'll run another query, with with starttime= nextstarttime. This will continue until nextstarttime=null, at which point all 100,000 incidents have been returned.

  • Was this article helpful?