-
Notifications
You must be signed in to change notification settings - Fork 30
Closed
Description
Description
The list_parsers() function fails to retrieve all parsers when called with log_type="-" (all log types). Only the first 100 parsers are returned, even when more parsers exist.
Root Cause
Lines 287-288 in src/secops/chronicle/parser.py check for the wrong response key:
if "next_page_token" in data:
params["pageToken"] = data["next_page_token"]The Chronicle API returns nextPageToken (camelCase), but the code checks for next_page_token (snake_case). This causes the pagination loop to terminate after the first page.
Evidence
Other Chronicle API methods in this SDK correctly handle nextPageToken:
src/secops/chronicle/rule.py(lines 476, 479)src/secops/chronicle/data_table.py(lines 57, 98)src/secops/chronicle/reference_list.py(line 163)
Impact
- When >100 total parsers exist across all log types, only the first 100 are returned
- Querying specific log types works correctly (returns all parsers for that type)
- No error is raised, making this a silent failure
Reproduction
from secops import SecOpsClient
client = SecOpsClient()
chronicle = client.chronicle(
customer_id="your-customer-id",
project_id="your-project-id",
region="us"
)
# Query all parsers
all_parsers = chronicle.list_parsers(log_type="-")
print(f"Returned {len(all_parsers)} parsers")
# Output: Returned 100 parsers (stops at first page)Proposed Fix
Change lines 287-288 to use camelCase:
if "nextPageToken" in data:
params["pageToken"] = data["nextPageToken"]Environment
- SDK Version: v0.25.2
- Python: 3.13+
- Tested with Chronicle production API
Metadata
Metadata
Assignees
Labels
No labels