Missing Logs from the API endpoint

Not as of yet, I will chase for you.

Yes please. Thank you

Hi Richard. Any progress on this yet please ?

Not at this time. Apologies.

FYI: the development team is looking at this.

I got the following statement back from development:

Variance in events data retrieved stems from the different time recorded for the event generation vs event ingestion. For example, an endpoint could generate an event, but not send it due to various scenarios (endpoint is offline, bandwidth, etc.). Events are retrieved based on the ingestion time both for UI and API, thus an event generated earlier may appear later in the list.

Hi Richard. Could you confirm this ? when has_more is False in a response, that cursor needs to be used again and again until the log count touches 200 which is the default number of logs sent. At the same time, there is the next cursor that needs to be used as well. Does this mean that we have to store the previous cursor which has less than 200 logs and the next cursor ?

Currently, where there is a nextCursor value supplied, we discard/ignore has_more value and always use the nextCursor to get the next batch of logs. But it seems to be as long as the cursor's log count is not 200, you cannot discard it. Is this right ?

Hi Richard. Could you also let us know why we are not able to see the Sophos Intercept X Logs at all using the above API ?