C#调用MCAS REST API获取活动日志时nextQueryFilters无法获取问题排查

我尝试用C#收集Microsoft Defender for Cloud的活动日志，参考Python示例，应该把nextQueryFilters的值作为过滤器传入，但运行代码后无法获取nextQueryFilters项，帮忙排查代码问题。

原代码： #

string tenantId = "mytenantId";
string appId = "myappId";
string appSecret = "myappSecret";

const string authority = "https://login.microsoftonline.com";
const string MCASResourceId = "myMCASResourceId";

AuthenticationContext auth = new AuthenticationContext($"{authority}/{tenantId}/");
ClientCredential clientCredential = new ClientCredential(appId, appSecret);
AuthenticationResult authenticationResult = auth.AcquireTokenAsync(MCASResourceId, clientCredential).GetAwaiter().GetResult();
string token = authenticationResult.AccessToken;

var httpClient = new HttpClient();
bool hasNextPage = false;

do
{
    string Url = "https://url.portal.cloudappsecurity.com/api/v1/activities/?filters={\"date\":{ \"gte_ndays\":1}}&isScan:True";
    using (var request = new HttpRequestMessage(HttpMethod.Post, Url))
    {
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
        using (HttpResponseMessage response = httpClient.SendAsync(request).GetAwaiter().GetResult())
        {
            string json = response.Content.ReadAsStringAsync().Result;
        }
    }
} while (hasNextPage);

问题排查与修复： #

• 请求方法错误：Defender for Cloud的活动日志API使用GET请求，而非代码中的POST，错误的请求方法会导致接口返回不符合预期，无法拿到分页相关字段。
• URL参数格式错误：
  • URL中的&是HTML转义字符，需替换为普通的&
  • 参数isScan:True格式错误，应改为isScan=True（用等号分隔键值）
• 未实现分页逻辑：
  • 初始hasNextPage设为false，会直接跳过循环，无法触发多页请求
  • 未从返回的JSON中提取nextQueryFilters，也未将其加入下一次请求的参数中
• 未解析JSON数据：仅读取JSON字符串但未反序列化，无法获取其中的nextQueryFilters等关键字段

修正后的代码示例： #

首先定义用于反序列化的类：

public class ActivityResponse
{
    public List<object> Activities { get; set; }
    public string NextQueryFilters { get; set; }
    // 根据实际返回字段补充其他属性
}

修正后的主逻辑：

string tenantId = "mytenantId";
string appId = "myappId";
string appSecret = "myappSecret";

const string authority = "https://login.microsoftonline.com";
const string MCASResourceId = "https://cloudappsecurity.azure.com"; // 注意：正确的MCAS资源ID应为这个，而非自定义值

AuthenticationContext auth = new AuthenticationContext($"{authority}/{tenantId}/");
ClientCredential clientCredential = new ClientCredential(appId, appSecret);
AuthenticationResult authenticationResult = auth.AcquireTokenAsync(MCASResourceId, clientCredential).GetAwaiter().GetResult();
string token = authenticationResult.AccessToken;

var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

bool hasNextPage = true;
string currentFilters = "{\"date\":{ \"gte_ndays\":1}}";

while (hasNextPage)
{
    string url = $"https://url.portal.cloudappsecurity.com/api/v1/activities/?filters={Uri.EscapeDataString(currentFilters)}&isScan=True";
    using (HttpResponseMessage response = httpClient.GetAsync(url).GetAwaiter().GetResult())
    {
        response.EnsureSuccessStatusCode(); // 确保请求成功，否则抛出异常
        string json = response.Content.ReadAsStringAsync().Result;
        ActivityResponse activityResponse = JsonConvert.DeserializeObject<ActivityResponse>(json); // 需要引用Newtonsoft.Json

        // 处理获取到的活动日志
        // ProcessActivities(activityResponse.Activities);

        // 更新分页状态和下一次请求的过滤器
        if (!string.IsNullOrEmpty(activityResponse.NextQueryFilters))
        {
            currentFilters = activityResponse.NextQueryFilters;
            hasNextPage = true;
        }
        else
        {
            hasNextPage = false;
        }
    }
}

内容的提问来源于stack exchange，提问作者베리블루