Forum Discussion
Solved
MDE API - How to get all devices?
I‘m currently trying to get alle device objects from MDE via REST API. Unfortunately, I only get 10.000 of my 23.000 machines.
The API Documentation states that the maximum pagesize is 10.000, but there is no hint or example where to get the other 13.000 machines that are still missing.
Anyone got the same problem or has a solution?
Best regards
Stefan
The API Documentation states that the maximum pagesize is 10.000, but there is no hint or example where to get the other 13.000 machines that are still missing.
Anyone got the same problem or has a solution?
Best regards
Stefan
- There is a new preview feature for M365 Defender: https://docs.microsoft.com/en-us/microsoft-365/security/defender/api-overview?view=o365-worldwide
that will return up to 100,000 rows:
https://docs.microsoft.com/en-us/microsoft-365/security/defender/api-advanced-hunting?view=o365-worldwide#quotas-and-resource-allocation
- Whenever you do a REST call and not all data is returned, you should see a property that contains another link with the rest of the data.
It's comparable to the Graph API way of doing pagination: https://docs.microsoft.com/en-us/graph/paging- Thanks, the @odata.nextLink did the trick. Thank you very much.
LuizaTMicrosoft
There is a new preview feature for M365 Defender: https://docs.microsoft.com/en-us/microsoft-365/security/defender/api-overview?view=o365-worldwide
that will return up to 100,000 rows:
https://docs.microsoft.com/en-us/microsoft-365/security/defender/api-advanced-hunting?view=o365-worldwide#quotas-and-resource-allocation- Hi Luiza,
thank you, I wasn't aware of that and will try this 🙂
Best regards
Stefan
Since the maximum number of numbers is the number of steps, consider using "| summarize make_list(DeviceName)" Advanced Hunting API etc. to reduce the number of line counts.
