Device control violation alert\bioc

NathanBradley — Tue, 07 Jun 2022 15:07:50 GMT

Im looking for a way to alert when a device control violation occurs

Currently ive not found a xql query that works

Re: Device control violation alert\bioc

KanwarSingh01 — Wed, 08 Jun 2022 00:57:51 GMT

The link also provides a hint on how you can built your own custom notification using the "Get Violation API".

What you can do here is, create a csv file of the violation being pulled from XDR API and then ingest in SIEM for notifications or other stuff.

Thank You