Dashboard creation for device temporary exceptions

Adriano_01 — Fri, 03 Nov 2023 17:59:06 GMT

I'm trying to create a dashboard with all temporary exceptions, but I can't find the database where the "Device Temporary Exceptions" is located.

Can someone help me

Re: Dashboard creation for device temporary exceptions

jtalton — Tue, 07 Nov 2023 16:07:36 GMT

Hello Adriano_01,

Unfortunately, the Device Temporary Exceptions data is not exposed in a dataset. XQL supports the ingestion of connect and disconnect events of USB devices that are reported by the agent, if the Device Configuration of the endpoint profile to Block. Reference Device Control • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

Please view the below screenshot to view all of the fields available to query in the device_control Preset:

preset = device_control
| filter event_type = DEVICE

Thank you