Add a limit to cs falcon search device command

Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py

@@ -1763,6 +1763,8 @@ def search_device(filter_operator='AND'):
         'site_name': str(args.get('site_name', '')).split(','),
         'local_ip': str(args.get('ip', '')).split(',')
     }
+    limit = int(args.get('limit', 50))
+    offset = int(args.get('offset', 0))
     url_filter = '{}'.format(str(args.get('filter', '')))
     op = ',' if filter_operator == 'OR' else '+'
     # In Falcon Query Language, '+' stands for AND and ',' for OR
@@ -1783,7 +1785,7 @@ def search_device(filter_operator='AND'):
                 # All args should be a list. this is a fallback
                 url_filter = "{url_filter}{operator}{inp_arg}:'{arg_val}'".format(url_filter=url_filter, operator=op,
                                                                                   inp_arg=k, arg_val=arg)
-    raw_res = http_request('GET', '/devices/queries/devices/v1', params={'filter': url_filter})
+    raw_res = http_request('GET', '/devices/queries/devices/v1', params={'filter': url_filter, 'limit': limit, 'offset': offset})
     device_ids = raw_res.get('resources')
     if not device_ids:
         return None

Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.yml

@@ -1,4 +1,4 @@
 category: Endpoint
 sectionOrder:
 - Connect
 - Collect
@@ -186,24 +186,30 @@
       auto: PREDEFINED
     - description: The query to filter the device.
       name: filter
-    - description: A comma-separated list of device IDs to limit the results.
+    - description: The maximum records to return [1-5000].
+      name: limit
+      defaultValue: 50
+    - description: The offset to start retrieving records from.
+      name: offset
+      defaultValue: 0
+    - description: 'A comma-separated list of device IDs to limit the results.'
       name: ids
     - auto: PREDEFINED
       description: 'The status of the device. Possible values are: "Normal", "containment_pending", "contained", and "lift_containment_pending".'
       name: status
       predefined:
-      - normal
+      - 'normal'
       - containment_pending
       - contained
       - lift_containment_pending
     - auto: PREDEFINED
-      description: The host name of the device.
+      description: 'The host name of the device.'
       name: hostname
       predefined:
       - ''
-    - auto: PREDEFINED
-      description: 'The platform name of the device. Possible values are: Windows, Mac, and Linux.'
+    - description: 'The platform name of the device. Possible values are: Windows, Mac, and Linux.'
       name: platform_name
+      auto: PREDEFINED
       predefined:
       - Windows
       - Mac
@@ -4962,7 +4968,7 @@
     - contextPath: CrowdStrike.IOARules.version_ids
       description: The IOA Rule's version ID.
       type: String
-  dockerimage: demisto/py3-tools:1.0.0.86612
+  dockerimage: demisto/py3-tools:1.0.0.88148
   isfetch: true
   ismappable: true
   isremotesyncin: true

Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon_test.py

@@ -3517,7 +3517,7 @@ def test_get_endpoint_command(requests_mock, mocker):
      - The user is running cs-falcon-search-device with an id
     Then
      - Return an Endpoint context output
-     """
+    """
     from CrowdStrikeFalcon import get_endpoint_command
     response = {'resources': {'meta': {'query_time': 0.010188508, 'pagination': {'offset': 1, 'limit': 100, 'total': 1},
                                        'powered_by': 'device-api', 'trace_id': 'c876614b-da71-4942-88db-37b939a78eb3'},
@@ -3560,13 +3560,14 @@ def test_get_endpoint_command(requests_mock, mocker):
         status_code=200,
     )
 
-    mocker.patch.object(demisto, 'args', return_value={'id': 'dentifier_numbe', 'hostname': 'falcon-crowdstr'})
+    mocker.patch.object(demisto, 'args', return_value={'id': 'identifier_numbe', 'hostname': 'falcon-crowdstr'})
 
     outputs = get_endpoint_command()
     result = outputs[0].to_context()
     context = result.get('EntryContext')
 
-    assert unquote(query_mocker.last_request.query) == "filter=device_id:'dentifier_numbe',hostname:'falcon-crowdstr'"
+    api_query = "filter=device_id:'identifier_numbe',hostname:'falcon-crowdstr'&limit=50&offset=0"
+    assert unquote(query_mocker.last_request.query) == api_query
     assert context['Endpoint(val.ID && val.ID == obj.ID && val.Vendor == obj.Vendor)'] == [endpoint_context]
 
 

Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/README.md

@@ -156,6 +156,8 @@ Searches for a device that matches the query.
 | hostname | The host name of the device. Possible values are: . | Optional | 
 | platform_name | The platform name of the device. Possible values are: Windows, Mac, and Linux. Possible values are: Windows, Mac, Linux. | Optional | 
 | site_name | The site name of the device. | Optional | 
+| limit | The maximum number of records to return. Default is 50. | Optional | 
+| offset | The offset to begin the list from. For example, start from the 10th record and return the list. Default is 0. | Optional |
 
 #### Context Output
 

Packs/CrowdStrikeFalcon/ReleaseNotes/1_13_0.json

@@ -0,0 +1,4 @@
+{
+    "breakingChanges": true,
+    "breakingChangesNotes": "Parameters *limit* (with defualt value 50) and *offset* (with defualt value 0), were introduced to ***cs-falcon-search-device*** command. Number of returned results will be defined by the limit"
+}

Packs/CrowdStrikeFalcon/ReleaseNotes/1_13_0.md

@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### CrowdStrike Falcon
+- Added the *limit* and *offset* parameter to the ***cs-falcon-search-device*** command.
+- Updated the Docker image to: *demisto/py3-tools:1.0.0.88148*.

Packs/CrowdStrikeFalcon/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "CrowdStrike Falcon",
     "description": "The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.",
     "support": "xsoar",
-    "currentVersion": "1.12.17",
+    "currentVersion": "1.13.0",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",