redcanaryco / surveyor

A cross-platform baselining, threat hunting, and attack surface analysis tool for security teams.
MIT License
169 stars 59 forks source link

101 requesting automatic termination of search after x time or y results #118

Closed TreWilkinsRC closed 1 year ago

TreWilkinsRC commented 1 year ago

Changes

Created one option: --limit allows user to specify number of results returned

Note

After conducting tests with the --limit option, it was determined that there is no need to implement an additional timeout option after x amount of time. Setting a limit should effectively achieve the desired outcome. Open to making adjustments based on specific requirements or needs.

Limits:

Cortex XDR: Default: 1000, Max: Default Microsoft Defender for Endpoint: Default: 100000, Max: 100000 SentinelOne (PowerQuery): Default/Max: 1000 SentinelOne (Deep Visibility): Default/Max: 20000 VMware Carbon Black EDR: Default/Max: None VMware Carbon Black Cloud Enterprise EDR: Default/Max: None

Note: Exceeding the maximum limits will automatically set the limit to its maximum value, where applicable.

closes #101