Creating a NewPageIterator for Run Hunting Query Using the Microsoft Graph SDK for Go

Question

I'm getting an 'Error creating page iterator: value property missing in response object' using the Microsoft Graph SDK in Go and trying to create a NewPageIterator. How can I resolve this issue?

The code works if I take the pagination part out. I'm trying to get pagination to work. I'm also using the Echo web framework, but my question is specifically to how to create a correct Page Iterator that will work with run hunting query

package handlers

import (
    "context"
    "encoding/json"
    "fmt"
    "io"
    "log"
    "net/http"
    "os"

    "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
    "github.com/labstack/echo/v4"
    msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
    msgraphcore "github.com/microsoftgraph/msgraph-sdk-go-core"
    "github.com/microsoftgraph/msgraph-sdk-go/models/security"
    graphsecurity "github.com/microsoftgraph/msgraph-sdk-go/security"
)

func getClientWithCredentials() (*msgraphsdk.GraphServiceClient, error) {

    tenantID := os.Getenv("AZURE_TENANT_ID")
    clientID := os.Getenv("AZURE_CLIENT_ID")
    clientSecret := os.Getenv("AZURE_CLIENT_SECRET")

    cred, err := azidentity.NewClientSecretCredential(tenantID, clientID, clientSecret, nil)

    if err != nil {
        fmt.Printf("Error creating credentials: %v\n", err)
    }

    client, err := msgraphsdk.NewGraphServiceClientWithCredentials(cred, nil)
    if err != nil {
        fmt.Printf("Error creating client: %v\n", err)
        return client, err
    }
    return client, nil
}

func RunKQL(c echo.Context) error {

    body, err := io.ReadAll(c.Request().Body)
    if err != nil {
        return err
    }
    query := string(body)

    timespan := c.QueryParam("timespan")

    client, err := getClientWithCredentials()
    if err != nil {
        c.Logger().Fatalf("Could not get access token: %v", err)
    }

    requestBody := graphsecurity.NewMicrosoftgraphsecurityrunhuntingqueryRunHuntingQueryPostRequestBody()
    requestBody.SetQuery(&query)
    if timespan != "" {
        requestBody.SetTimespan(&timespan)
    }
    result, err := client.Security().MicrosoftGraphSecurityRunHuntingQuery().Post(context.Background(), requestBody, nil)
    if err != nil {
        c.Logger().Fatalf("Error running hunting query: %v", err)
    }

    // Initialize iterator - this is not working to create a NewPageIterator
    pageIterator, err := msgraphcore.NewPageIterator[*security.HuntingQueryResultsable](
        result,
        client.GetAdapter(),
        security.CreateHuntingQueryResultsFromDiscriminatorValue)
    if err != nil {
        log.Fatalf("Error creating page iterator: %v\n", err)
    }

    //Iterate over all pages
    jsonObjects := make([]map[string]interface{}, 0)
    err2 := pageIterator.Iterate(
        context.Background(),
        func(pageItem *security.HuntingQueryResultsable) bool {
            // Process each page item here
            if results := (*pageItem).GetResults(); results != nil {
                for _, result := range results {
                    jsonData := result.GetAdditionalData()
                    jsonObjects = append(jsonObjects, jsonData)
                }
            }
            // Return true to continue iterating to the next page
            return true
        })
    if err2 != nil {
        log.Fatalf("Error iterating over security results: %v\n", err2)
    }

    //Working without using Page Iterator
    // jsonObjects := make([]map[string]interface{}, 0)
    // for _, result := range result.GetResults() {
    //  jsonData := result.GetAdditionalData()
    //  jsonObjects = append(jsonObjects, jsonData)
    // }

    jsonRes, err := json.MarshalIndent(jsonObjects, "", "  ")
    if err != nil {
        fmt.Println("Error marshalling JSON array:", err)
        return c.String(http.StatusInternalServerError, "Error generating JSON response")
    }

    return c.String(http.StatusOK, string(jsonRes))
}

Answer 1

What you get as result is a security.HuntingQueryResultsable which is not a collection (like security.AlertCollectionResponseable), so it's missing a GetValue function.

This is what “value property missing in response object” means - you can't iterate through the result, since it's not a collection.