topic Re: Device Control Violations & XQL in Cortex XDR Discussions

Device Control Violations & XQL

KRisselada — Wed, 11 Aug 2021 15:45:37 GMT

Has anyone been able to get a XQL Query together that could pull out the Device Control Violations ?
Unfortunately at this point, while they are presented in Cortex XDR, I don't see a way to Export that page contents

Same with Disk Encryption Visibility, but at least with that one, there is at least a "Disk Encryption Compliance" Widget. But also see no widget for Device Control.

Re: Device Control Violations & XQL

malalade — Fri, 13 Aug 2021 19:42:52 GMT

Currently, there is no option to export both on "Device Control Violations" and "Disk Encryption Visibility" pages. However, we have submitted a feature request on your behalf. Also XQL dataset currently does not include alert data. If convenient, you could adapt "Get Violations" XDR API - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/endpoint-management/get-violations.html