[ BUG ] NGSIEM GetSearchStatusV1 doesn't support pagination

[59e5aaf4]

Describe the bug
GetSearchStatusV1 doesn't support pagination

To Reproduce
Try to use pagination. There's none.

Expected behavior
Either you:

• implement paginationLimit + paginationOffset like in the web UI (they're not even used there lolol), or
• implement the web UI behavior of re-launching the query with shorter time frames picked from the last event @timestamp ( happens when you scroll to force content to load in your browser )

This would

Environment (please complete the following information):

• OS: Debian
• Python: 3.13.5
• FalconPy: 1.5.3

Additional context
I need to dump host telemetry for a handful of hosts for retention reasons ( involved in IR + legal stuff ) and scrolling in my browser is not an option. Also my previous code that reduces time windows in the mimicked webui client is, uh, barely functional so if there was an official way to enumerate pages of content that would be great 💖

Thanks !

[59e5aaf4]

OK solved by bypassing FalconPy using direct API calls (pulling auth from headers = self.falcon.headers() :D). paginationLimit is a secret HTTP parameter one can use in addition to around.numberOfEventsBefore in the JSON POST when creating a request so that you mimic the webui enumeration behavior. We successfully got 4k items per query ( 1.5MB ) and could exhaust results for a single query.

I ended up with 2 functions :

• enumerate_query - calls exec_query repeteadly patching the POST JSON with an around value like in the web UI
• exec_query - just launches & pulls one single result ( busypolls 1s until it's done=True )

Bonus, I could set "computeFieldStats":False because I don't need that.

This allows us to pull a single host telemetry data and meet our retention needs. It's not as effective as LTR/FDR but it doesn't require billing or server setup, and works now :D

Thanks again for a really cool API wrapper, here I'm showing off bypassing StartSearchV1 and GetSearchStatusV1 but I do really get why you had to make a wrapper so that things would be simple. Cheers !