Summary
For the asset_vulnerability_summary data stream, we're collecting data from the REST API using CEL and HTTPJSON input. However, the pagination logic for the HTTPJSON input appears to be incorrect.
|
request.transforms: |
|
- set: |
|
target: header.X-Auth-Token |
|
value: {{custom_api_secret_key}}/{{custom_api_id}} |
|
- set: |
|
target: body.start |
|
value: '0' |
|
value_type: int |
|
- set: |
|
target: body.rows |
|
value: '10000' |
|
value_type: int |
|
response.pagination: |
|
- set: |
|
target: body.start |
|
value: '[[if (eq (len .last_response.body.results) 0)]][[.last_response.terminate_pagination]][[end]]' |
|
value_type: int |
|
fail_on_template_error: true |
In response.pagination, we're evaluating body.start, but we're not properly updating the start parameter to collect subsequent rows of events.
Additionally, we're using an incorrect value for body.rows. According to the documentation, the maximum value should be 1000.
This issue needs to be addressed to ensure proper data collection from the Carbon Black Cloud Vulnerability Assessment API.
Summary
For the
asset_vulnerability_summarydata stream, we're collecting data from the REST API using CEL and HTTPJSON input. However, the pagination logic for the HTTPJSON input appears to be incorrect.integrations/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/agent/stream/httpjson.yml.hbs
Lines 18 to 35 in 47a663f
In
response.pagination, we're evaluatingbody.start, but we're not properly updating thestartparameter to collect subsequent rows of events.Additionally, we're using an incorrect value for
body.rows. According to the documentation, the maximum value should be 1000.This issue needs to be addressed to ensure proper data collection from the Carbon Black Cloud Vulnerability Assessment API.