How can I see the device control violations logs from XQL?

[Rolando_Pena]

Good afternoon,

Is there a way to see the logs that are generated in Device control Violations?

I know that using preset = device_control in XQL we can see devices but this preset does not give me all the data that appears in the Violations section...

I need to see all the fields like these that appear:

How can I obtain the information about the devices that were blocked using XQL?

Thank you

[aspatil]

Hello @Rolando_Pena ,

Thanks for reaching out on LiveCommunity!

Please try below query:

preset = device_control
| filter event_sub_type = ENUM.DEVICE_PLUG

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".