topic Re: How can I see the device control violations logs from XQL? in Cortex XDR Discussions

How can I see the device control violations logs from XQL?

Rolando_Pena — Fri, 12 Jul 2024 19:05:42 GMT

Good afternoon,

Is there a way to see the logs that are generated in Device control Violations?

I know that using preset = device_control in XQL we can see devices but this preset does not give me all the data that appears in the Violations section...

I need to see all the fields like these that appear:

How can I obtain the information about the devices that were blocked using XQL?

Thank you

Re: How can I see the device control violations logs from XQL?

aspatil — Tue, 16 Jul 2024 07:00:37 GMT

Hello @Rolando_Pena ,

Thanks for reaching out on LiveCommunity!

Please try below query:

preset = device_control
| filter event_sub_type = ENUM.DEVICE_PLUG

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

Re: How can I see the device control violations logs from XQL?

Vinothkumar_SBA — Wed, 28 May 2025 07:24:35 GMT

Hi Aspatil,

I have reviewed this query, but I only see the action device bus type showing as USB. However, I was expecting details of blocked Bluetooth devices in the XQL query. Could you please help me check if this is possible