Why can't I run a query on a limit greater than 5000 (intel ioc) ?

[NSH531]

To circumvent this limitation I have to run a script that runs at a time on 5000 indicators.

[jshcodes]

Hi @NSH531!

This limitation is maintained by the API endpoint, and not FalconPy.

You're correct that you will need to loop and process indicators in batches due to this limitation.

We will have an example posted online shortly that specifically demonstrates how to iterate Intel indicators. Expect this by the end of the month. 😄

[NSH531]

Hi @jshcodes!
I'll glad to get the code sample.
I'm working on a pretty serious project in the field.
:)

[jshcodes]

You got it! I'll post an update here once that repository moves to public. (Should be happening within the next day or so.)

[NSH531]

Thanks

[jshcodes]

Hi @NSH531 -

The repo I mentioned is online now and available here: https://github.com/CrowdStrike/MISP-tools

This should give you a good example of pagination. 😄

[NSH531]

In which .py file is the relevant code?

[jshcodes]

https://github.com/CrowdStrike/MISP-tools/blob/main/cs_misp_import/intel_client.py#L56