AlienVault-OTX / OTX-Python-SDK

The Python SDK for AlienVault OTX
Other
357 stars 162 forks source link

Limit returned fields #17

Open alaaalii opened 8 years ago

alaaalii commented 8 years ago

The endpoint GET /api/v1/pulses/{pulse_id} does not have the ability to limit the returned fields, or limit the number of indicators returned.

Example of not supporting limit to limit the indicators:

>>> pulse_id = '57eee565e65dd9042acfc830'
>>> pulse_url = otx.create_url(PULSE_DETAILS + str(pulse_id), limit=10)
>>> pulse_url
'https://otx.alienvault.com/api/v1/pulses/57eee565e65dd9042acfc830?limit=10&'
>>> pulse = otx.get(pulse_url)
>>> len(pulse['indicators'])
643

In the example, the pulse queried has 643 indicators, and even if I pass the parameter limit=10, I still get all 643.

I'd like to be able to limit the size of the response either by limiting the number of indicators returned, or by requesting specific fields to be only included in the response, for example:

otx.get('https://otx.alienvault.com/api/v1/pulses/57eee565e65dd9042acfc830?fields=name,author_name')

The reason I want to do this is because I want to be able to only get details of a pulse (for example, its name and author) by its pulse_id. I tried doing this using a search, but pulse IDs are not a supported query:

>>> otx.search_pulses('57ef3a9be65dd9042acfd1b0')
{u'count': 0, u'groups_count': 0, u'exact_match': u'', 'results': [], u'users_count': 0}

Is there any other way I can get the details of a pulse ID without having to pull all of its indicators?

bsmartt13 commented 7 years ago

https://otx.alienvault.com/api (see the docs tab) I don't think there's a way to get the pulse metadata only, by id. It's basically what search pulses returns, but that's list of pulses not by id.

for what it's worth you can get the indicators in paginated format using the indicators endpoint:

GET /api/v1/pulses/{id}/indicators Returns paginated list view of the indicators inside the pulse pulse_id

these are interesting ideas though