Paging

[FrankG]

To perform paging with the Graph API you are supposed to check for the: @odata:nextLink property in the results.  This property will not appear if you set $top=12 or greater.  $top=11 or smaller will return the nextLink property.  You can test in the Graph Explorer.

This will not return the nextLink property:

https://graph.microsoft.com/v1.0/security/alerts?$top=12&$filter=createdDateTime%20ge%202018-08-02T2...

This will return the nextLink property:

https://graph.microsoft.com/v1.0/security/alerts?$top=11&$filter=createdDateTime%20ge%202018-08-02T2...

[#2]

Hi Frank,

The Microsoft Graph Security API will not return a next link when no additional alerts can be returned, or if you have reached the 6000 top+skip limit. In this case you are using our demo data, where we currently have 11 demo alerts for one of the providers. Which is why after $top=11 you no longer receive a next link. 

Thanks,

Edward

[#3]

There are more than 20 alerts.  It is the sample dataset from the Hackathon

[#4]

Yes, $top returns the most recent alerts from each of our providers. So if you were to query the sample dataset for $top=1, you would get back 8 alerts. Because we currently have 8 providers returning 1 of their most recent alerts.

[#5]

so if I do $top=50 - in theory if there are 50 providers - I could get back 2500 alerts ( pass the total alerts allowed to be returned).  I did not know that the $top was specific to the Provider - is that in the documentation?  

[#6]

Yes that is correct you would get back 2500 alerts. $top is documented in the List alerts page, but we may need to clarify that.