A tool that provides visibility, control, and threat protection for cloud-based applications and services
Inconsistency in API behaviour for Activities API for Microsoft Defender for Cloud Apps product
I am currently trying to fetch the Activities data for the MS Defender for Cloud Apps. We have used the below body parameters to fetch the data
{
"filters": {
"date": {
"gte": 1781698041000
}
},
"isScan": true,
"sortDirection": "asc",
"sortField": "date"
}
We are observing that in the response we are getting the "hasNext" key as false and the "data" key as "[]" empty array even when the data is present and the "total" key shows the data count present. However, when we increase the time by one milli sec, then the data comes in next call.
Any reason why we are facing this issue in the API? Also want to know that wether this could cause a data loss in polling the data?
Attaching the screenshots of this behaviour to validate it.
Fetched data for gte 1780651981001 time. Received next time 1780651983000.
Fetched data for gte 1780651983000 time. Showing no data event if total greater than 0. And hasNext is false too.
Fetched data for gte 1780651983001 time. And we are getting data now.
Other Doc references: