zdx_list_devices
Retrieve a list of active ZDX devices with optional filters for email, user, location, MAC/IP, and time window; returns device IDs for further analysis.
Instructions
List active ZDX devices.
Read-only. Returns one identifying row per device (id, hostname, owning
user). Filter by email, user ID, MAC/IP, location/department/geo, and the
since HOURS window. Use a returned device id with zdx_get_device or the
deep-trace / probe tools.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get the full records. | |
| since | No | ||
| emails | No | ||
| geo_id | No | ||
| offset | No | ||
| user_ids | No | ||
| location_id | No | ||
| mac_address | No | ||
| private_ipv4 | No | ||
| department_id | No |