Issue/Help with "Get Runtime Container Audit Events"

[bsjigi]

Documentation link

https://pan.dev/prisma-cloud/api/cwpp/get-audits-runtime-container/

Describe the problem

we can't check latest container runtime audits by using this api it shows only 50 container runtime audits which starts from initial audits. we checked that other API give us 50 audits, which starts from latest audits but only this API gives us different result.

Suggested fix

please let this API to give us latest container runtime audits

[welcome-to-palo-alto-networks[bot]]

:tada: Thanks for opening your first issue here! Welcome to the community!

[Pubs-MV]

@ssugandh is this addressed?

[ssugandh]

There's a similar issue here: https://redlock.atlassian.net/browse/PCSUP-14426

The limit query parameter for PCCE is 250 but the default is 50 and so it can be tweaked to get more than 50 results. But, for PCEE, it will be 50 maximum. It's mentioned in the parameter description.

About the ordering (sort by latest), you can use the query paramter reverse along with limit. But, there're certain APIs that give results starting with the latest. So, it's an engineering problem to either make all APIs behave similarly or call out the ones that needs to use the query parameter reverse.