API Limit

Hey Anumpa.

1st off you have to start doing some allow listing to remove the known noise from your reporting, else it will be impossible to find the unknown in you environment.

Then you can workaround the API restriction by for calling batches of time. and configure a warning of you exceed 10K events in one batch, using below 

$TimePeriod_EndDate = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$TimePeriod_StartDate = (Get-Date).AddDays(-1).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")


# Process events in 1-hour batches
$startTime = [DateTime]::Parse($TimePeriod_StartDate)
$endTime = [DateTime]::Parse($TimePeriod_EndDate)
$batchSize = 1 # 1 hour batches
# Loop through each hour in the 24-hour period


        # Add the check here
        If ($totalRecordCount -eq 10000) {
            Write-Error "Maximum record limit reached (10,000 records)"
            Break

Again. Allow-listing is crucial, I bet if you filter on Allowed application that will be 95% of the events on you system, number one app is Chrome, Slack and others that run without admin rights from the users profile. Set the filter to 30 days, which is the retention for Allowed Events. (Passive events 106)

Kind regards

Jens