Skip to content

Commit

Permalink
fix(SentinelOne): fix the pagination for the singularity connector
Browse files Browse the repository at this point in the history
  • Loading branch information
squioc committed Dec 13, 2024
1 parent df6c5d9 commit c216679
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 13 deletions.
25 changes: 13 additions & 12 deletions SentinelOne/sentinelone_module/singularity/connectors.py
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,6 @@ def __init__(self, *args: Any, **kwargs: Optional[Any]) -> None:
start_at=timedelta(days=7),
ignore_older_than=timedelta(days=7),
)
self.last_checkpoint = CheckpointCursor(path=self.data_path)

@cached_property
def client(self) -> SingularityClient:
Expand All @@ -56,36 +55,38 @@ def stop(self, *args: Any, **kwargs: Optional[Any]) -> None:
async def single_run(self) -> int:
result = 0

# Set up parameters
last_event_date = self.last_event_date.offset
while self.running:
cursor: str | None = self.last_checkpoint.offset
if cursor == "": # TODO: Fix this in SDK in cursor handling.
cursor = None
start_time = int(last_event_date.timestamp())
cursor: str | None = None
has_more_items: bool = True

start_time = int(last_event_date.timestamp()) if not cursor else None
# Iter over the responses
while self.running and has_more_items:
# Get the next alerts
data = await self.client.list_alerts(
product_name=self.product_name,
start_time=start_time if cursor is None else None,
after=cursor,
start_time=start_time,
)

# Push the collected alerts
pushed_events = await self.push_data_to_intakes(
[orjson.dumps(alert).decode("utf-8") for alert in data.alerts]
)

result += len(pushed_events)

# Save the most recent date seen
for alert in data.alerts:
alert_detected_at = isoparse(alert["detectedAt"])
if alert_detected_at > last_event_date:
last_event_date = alert_detected_at

self.last_checkpoint.offset = data.end_cursor

if not data.has_next_page:
break
# Update parameters for the next page (if exists)
cursor = data.end_cursor
has_more_items = data.has_next_page

self.last_checkpoint.offset = ""
self.last_event_date.offset = last_event_date

return result
Expand Down
2 changes: 1 addition & 1 deletion SentinelOne/tests/singularity/test_connectors.py
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ def gql_return_values(query, variable_values) -> dict[str, Any]:
return {
"alerts": {
"totalCount": 0,
"pageInfo": {"endCursor": "cursor-1", "hasNextPage": False},
"pageInfo": {"endCursor": None, "hasNextPage": False},
"edges": [{"node": alert}, {"node": alert}],
}
}
Expand Down

0 comments on commit c216679

Please sign in to comment.