device_control_get_violations
Retrieve device control violations from Cortex XSIAM using filters on endpoint, type, timestamp, and more. Supports pagination to fetch up to 100 filtered results for security analysis.
Instructions
Get Violations
Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.
When filtering by multiple fields:
Response is concatenated using AND condition (OR is not supported).
Maximum result set size is 100.
Offset is the zero-based number of incidents from the start of the result set.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/device_control/get_violations] · Endpoint Management
Example request body:
{
"request_data": {
"filters": [
{
"field": "type",
"operator": "in",
"value": [
"disk drivE"
]
}
],
"search_to": 1
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | No | An empty object returns all results. |