{"code":400,"message":"offset 10000 and limit 100 are invalid; offset + limit must be less than or equal to 10000"} about psfalcon

[bk-cs]

This is normal and expected behavior; the majority of the CrowdStrike APIs won't return more than 10,000 results--they're designed to return the results of a filtered search, not "all data". -All is provided as a "best effort" fashion to return whatever the API will allow you to retrieve through pagination.

In general, it's best to try different filter values until you have a total result set of less than 10,000. Breaking the results into groups using timestamps, names, etc.

Here's an example script that will break "applications" up into smaller groups when using the Falcon Discover APIs: https://github.com/CrowdStrike/psfalcon/blob/dev/samples/discover/retrieve_hosts_and_their_applications.ps1

[brushenas]

I have seen in other CrowdStrike GIT repository where they are able to return all data by leveraging the meta data as explained in the following link. is it something that can be leveraged for this PS module?

CrowdStrike/falconpy#536

[bk-cs]

That's a difference in the APIs. Get-FalconHost, which calls the API referenced in that python issue (GET /devices/queries/devices-scroll/v1), will return all results when used with -All. It is one of the few that will return all results without a limit.

PSFalcon's -All will return all results when the API allows. If the API doesn't allow it, you're going to get an error at 10,000 results. This is also mentioned in the documentation for the All parameter: https://github.com/CrowdStrike/psfalcon/wiki/Importing,-Syntax-and-Output#all