Note: I am posting this on behalf of my colleague / engineering team who identified the issue and root cause. If technical follow-up questions are needed, I will relay them back to our engineers.
Following up on similar errors reported across the API (such as thread 7116), my colleagues have identified a reproducible issue where the endpoint CaseWallRecordService.ListCaseWallRecords (and its REST equivalent cases.caseWallRecords.list) crashes with an HTTP 500 stream termination error.
This issue also breaks the official Python SDK (google/secops-wrapper) when using standard pagination utilities (secops.chronicle.utils.request_utils).
Symptoms & Reproduction
When iterating through paginated wall records on a case that contains heavy entries (e.g., automated execution logs, script outputs, or artifact dumps >10MB), the API abruptly resets the connection once a page aggregates too much data.
Root Cause Analysis
The HTTP/2 frame RST_STREAM with error code: NO_ERROR occurs when an intermediate reverse proxy (Google Front End / Envoy) or gRPC channel forcibly terminates an active stream without trailers.
While the requested pageSize (e.g., 100) is well within the documented 1,000 item limit, the cumulative byte size of those 100 records exceeds the proxy/gateway maximum response buffer (typically 10MB–32MB).
According to Google API Design Guide AIP-158 (Pagination):
"The API may return fewer results than the number requested (including zero results), even if not at the end of the collection."
Instead of returning fewer records alongside a next_page_token when accumulated byte size approaches transfer limits, the backend attempts to serialize the full requested count, triggering the proxy-level stream reset.
Client-Side Workaround
As a client-side workaround, an adaptive page-size backoff can be implemented. When receiving 500 INTERNAL / RST_STREAM, the script catches the error, retries the request with a progressively halved pageSize (down to pageSize=1 if needed to isolate the single heavy record), and resumes pagination.
Suggested fixes for the secops team
Update CaseWallRecordService to monitor cumulative response payload size during batch serialization and return a smaller page with nextPageToken (per AIP-158) before breaching proxy limits.
Update google/secops-wrapper pagination helpers (request_utils.py) to gracefully handle payload-induced stream resets or default to safer page sizes for wall activity endpoints.
