Identity protection pagination

[cl6227]

Is there a way to use GraphQL queries that paginate? I'd like a report that returns more than 1000 results (the limit without paginating).

I'm using IdentityProtection / falcon.graphql: https://github.com/CrowdStrike/falconpy/wiki/Identity-Protection

The response object contains 'hasNextPage' and 'endCursor' values to obtain the next page of results. How can I use this information to gather the next page of data?

response["body"]["data"]["entities"]["pageInfo"]["hasNextPage"] = True
response["body"]["data"]["entities"]["pageInfo"]["endCursor"] = eyJfaWQiOiIwMDAwdWJiOS01YzQxLTRmNzctODhmNy02MWFjOGQ1ZDViNztifQ==

An example graphql query that has pagination enabled is below. You'll note that I only have 'first' set to 2 so the output response is small and can be easily read for troubleshooting. However with pagination enabled, it should repeat batches of 2 results until all results have been obtained. Normally 'first' would be set to 1000.

    idp_query = """
      query ($after: Cursor, $enabled: Boolean)
  {
  entities(types: [USER]
    archived: false
    enabled: $enabled
    after: $after
    first: 2
    dataSources: [ACTIVE_DIRECTORY]) {
    nodes {
            primaryDisplayName
            secondaryDisplayName
            riskScoreSeverity
            riskFactors {
              type
              severity
            }
            isHuman: hasRole(type: HumanUserAccountRole)
             isProgrammatic: hasRole(type: ProgrammaticUserAccountRole)
             roles {
              fullPath
              probability
            }
            accounts {
              description
              ... on ActiveDirectoryAccountDescriptor{
                passwordAttributes{
                  lastChange
                }
                creationTime
                objectSid
                samAccountName
                domain
                enabled
                ou
                lastUpdateTime
                department
                servicePrincipalNames
                upn
                dn
                title
                userAccountControl
                objectGuid
              }
            }
        }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
  }
  """

falconpy 1.2.8
Python 3.9.2
OS Win 2012 R2

[jshcodes]

Hi @cl6227 -

Thank you for pointing this out! This has resulted in a bug determination that will be addressed in our next release.

In the interim, you can work around this issue by moving away from using the query keyword over to using the body keyword. (i.e. work with raw JSON dictionaries as opposed to leveraging body payload abstraction.)

Here's a quick example I used to test and confirm this issue.

from falconpy import IdentityProtection

idp_query = """
query ($after: Cursor) {
  entities(types: [USER], archived: false, learned: false, first: 10, after: $after) {
    nodes {
      primaryDisplayName
      secondaryDisplayName
      accounts {
        ... on ActiveDirectoryAccountDescriptor {
          domain
        }
      }
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}
"""
idp = IdentityProtection(client_id=CLIENT_ID, client_secret=CLIENT_SECRET)

running = True
returned_nodes = []
submit_body = {"query": idp_query}
while running:
    print("Requesting a page of results")
    result = idp.graphql(body=submit_body)
    if result["status_code"] != 200:
        raise SystemExit("API error, check query contents.")
    if result["body"]["data"].get("entities"):
        if "nodes" in result["body"]["data"]["entities"]:
            returned_nodes.extend(result["body"]["data"]["entities"]["nodes"])
            page_info = result["body"]["data"]["entities"]["pageInfo"]
            if page_info["hasNextPage"]:
                submit_body["variables"] = {
                    "after": page_info["endCursor"]
                }
            else:
                running = False
        else:
            running = False
    else:
        raise SystemExit("No results returned.")

for node in returned_nodes:
    print(node["primaryDisplayName"])

[cl6227]

Hello jshcodes, thank you for your response. I tried the code you supplied and I am seeing pagination now.

For anyone who uses the code above, there is no error alerting, so may want to print "result" immediately when testing in case you pass an invalid graphQL query (like I did). After updating it, I am able to get more than one page!

I noticed this is fixed in falconpy version 1.2.11, I will stand by until the wiki page is updated on usage of the new "variables" keyword, thanks again.

[jshcodes]

Good catch! Updated the code above to check for bad returns. 😄

[jshcodes]

This discussion was used to create a new GraphQL pagination sample! 😄