Dashboard creation for device temporary exceptions

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Dashboard creation for device temporary exceptions

L0 Member

I'm trying to create a dashboard with all temporary exceptions, but I can't find the database where the "Device Temporary Exceptions" is located.

Can someone help me


L3 Networker

Hello Adriano_01, 


Unfortunately, the Device Temporary Exceptions data is not exposed in a dataset. XQL supports the ingestion of connect and disconnect events of USB devices that are reported by the agent, if the Device Configuration of the endpoint profile to Block. Reference Device Control • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation port...


Please view the below screenshot to view all of the fields available to query in the device_control Preset:

preset = device_control
| filter event_type = DEVICE



Thank you

If you found this answer helpful, please select Accept as Solution.
  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!