SOLVED

MDE API - How to get all devices?

%3CLINGO-SUB%20id%3D%22lingo-sub-2454674%22%20slang%3D%22en-US%22%3EMDE%20API%20-%20How%20to%20get%20all%20devices%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2454674%22%20slang%3D%22en-US%22%3EI%E2%80%98m%20currently%20trying%20to%20get%20alle%20device%20objects%20from%20MDE%20via%20REST%20API.%20Unfortunately%2C%20I%20only%20get%2010.000%20of%20my%2023.000%20machines.%3CBR%20%2F%3EThe%20API%20Documentation%20states%20that%20the%20maximum%20pagesize%20is%2010.000%2C%20but%20there%20is%20no%20hint%20or%20example%20where%20to%20get%20the%20other%2013.000%20machines%20that%20are%20still%20missing.%3CBR%20%2F%3E%3CBR%20%2F%3EAnyone%20got%20the%20same%20problem%20or%20has%20a%20solution%3F%3CBR%20%2F%3E%3CBR%20%2F%3EBest%20regards%3CBR%20%2F%3EStefan%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2461194%22%20slang%3D%22en-US%22%3ERe%3A%20MDE%20API%20-%20How%20to%20get%20all%20devices%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2461194%22%20slang%3D%22en-US%22%3E%3CP%3ESince%20the%20maximum%20number%20of%20numbers%20is%20the%20number%20of%20steps%2C%20consider%20using%20%22%7C%20summarize%20make_list(DeviceName)%22%20Advanced%20Hunting%20API%20etc.%20to%20reduce%20the%20number%20of%20line%20counts.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2462974%22%20slang%3D%22en-US%22%3ERe%3A%20MDE%20API%20-%20How%20to%20get%20all%20devices%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2462974%22%20slang%3D%22en-US%22%3EThere%20is%20a%20new%20preview%20feature%20for%20M365%20Defender%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender%2Fapi-overview%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender%2Fapi-overview%3Fview%3Do365-worldwide%3C%2FA%3E%20%3CBR%20%2F%3Ethat%20will%20return%20up%20to%20100%2C000%20rows%3A%20%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender%2Fapi-advanced-hunting%3Fview%3Do365-worldwide%23quotas-and-resource-allocation%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender%2Fapi-advanced-hunting%3Fview%3Do365-worldwide%23quotas-and-resource-allocation%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2463861%22%20slang%3D%22en-US%22%3ERe%3A%20MDE%20API%20-%20How%20to%20get%20all%20devices%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2463861%22%20slang%3D%22en-US%22%3EHi%20Luiza%2C%3CBR%20%2F%3Ethank%20you%2C%20I%20wasn't%20aware%20of%20that%20and%20will%20try%20this%20%3A)%3C%2Fimg%3E%3CBR%20%2F%3E%3CBR%20%2F%3EBest%20regards%3CBR%20%2F%3EStefan%3C%2FLINGO-BODY%3E
Contributor
I‘m currently trying to get alle device objects from MDE via REST API. Unfortunately, I only get 10.000 of my 23.000 machines.
The API Documentation states that the maximum pagesize is 10.000, but there is no hint or example where to get the other 13.000 machines that are still missing.

Anyone got the same problem or has a solution?

Best regards
Stefan
5 Replies

Since the maximum number of numbers is the number of steps, consider using "| summarize make_list(DeviceName)" Advanced Hunting API etc. to reduce the number of line counts.

best response confirmed by SteBeSec (Contributor)
Hi Luiza,
thank you, I wasn't aware of that and will try this :)

Best regards
Stefan
Whenever you do a REST call and not all data is returned, you should see a property that contains another link with the rest of the data.
It's comparable to the Graph API way of doing pagination: https://docs.microsoft.com/en-us/graph/paging
Thanks, the @odata.nextLink did the trick. Thank you very much.