We use the API to collect date from incidents into a management reporting tool.
The data returned by the API sometimes does not reflect the correct data in SOAR.
Some fields (e.g. determined_date) area always returned empty, and in some cases we get incident data spread over two records.

FYI : used version is 51.0.10.0

Script for call (essentials only - as it is later parsed into a CSV whith some cleaning up of the fields) 

# =====================================================================
# MAIN EXPORT SCRIPT
# =====================================================================

def main():

    CUSTOM_CONFIG_PATH = "/mgmt/data/xu6/.resilient/app.config"

    if not os.path.exists(CUSTOM_CONFIG_PATH):
        print(f"Error: Configuration file not found at: {CUSTOM_CONFIG_PATH}")
        return

    parser = resilient.ArgumentParser(config_file=CUSTOM_CONFIG_PATH)
    opts = parser.parse_args()

    try:
        client = resilient.get_client(opts)
    except Exception as e:
        print(f"Authentication failed: {e}")
        return

    # -------------------------------------------------------------
    # Load lookup data from cache, or rebuild it when stale/missing
    # -------------------------------------------------------------

    field_value_maps, identity_fields, identity_map = get_lookup_data(client)

    # -------------------------------------------------------------
    # Query incidents
    # -------------------------------------------------------------

    one_year_ago = datetime.utcnow() - timedelta(days=365)
    one_year_ago_ms = int(time.mktime(one_year_ago.timetuple()) * 1000)

    query_uri = "/incidents/query?return_level=full"

    query_payload = {
        "filters": [
            {
                "conditions": [
                    {
                        "field_name": "create_date",
                        "method": "gte",
                        "value": one_year_ago_ms
                    }
                ]
            }
        ]
    }

    print(
        f"Querying incidents created since "
        f"{one_year_ago.strftime('%Y-%m-%d %H:%M:%S')}..."
    )

    try:
        response = client.post(query_uri, query_payload)
    except Exception as e:
        print(f"REST Query Execution Failed: {e}")
        return

    if isinstance(response, dict) and "data" in response:
        incidents = response["data"]
    else:
        incidents = response

    if incidents is None:
        incidents = []

------------------------------
Guido Janssens
CERT - Information Risk Officer
KBC Group NV
------------------------------