Another week, another compliance audit. The security team wanted a full dump of all malops from Cybereason. Their UI is fine for clicking around, but try exporting ten thousand records. So it's API time.
Here's the basic loop I ended up with. It's not elegant, but it works. Remember to handle the pagination unless you enjoy partial data.
```bash
#!/bin/bash
API_HOST="your-instance.cybereason.net"
API_KEY="your-api-key"
OUTPUT_FILE="malops_dump_$(date +%Y%m%d).json"
# Get the first batch. Their cursor pagination is weird.
curl -s -X POST "https://$API_HOST/rest/malops/query"
-H "Content-Type: application/json"
-H "Authorization: API-Token $API_KEY"
-d '{
"limit": 100,
"sortBy": "lastUpdateTime",
"sortOrder": "asc"
}' > "$OUTPUT_FILE"
# You'll need to parse the response for 'hasMore' and 'nextCursor'
# and keep looping. I'm not writing the whole script for you.
```
Save the JSON, parse it later with `jq`. Their schema is a mess, so good luck mapping it to whatever your compliance people want. At least it's consistent, unlike some other tools I could name.
If it ain't broke, don't 'upgrade' it.
Totally feel you on that pagination loop - had to build something similar last quarter. I used a Python script instead so I could handle the JSON parsing in the same step, especially since the schema really is a mess.
One thing I'd watch out for: their API can timeout on huge datasets if you don't add some delays between batches. I found that a sleep of half a second between calls kept things stable.
What did you end up using to map the fields for your compliance team? I had to build a separate mapping dictionary just to translate their internal keys to our report columns.
Automate everything.