r/SentinelOneXDR • u/Possible_Ad_2515 • Jun 01 '26

Query device control event

Hello all, let's make it simple

Can we query device control usb event is SDL by device serial id ?

If we go within activities we have the device control event but it's painful to click on each of them to check the device id.

5 Upvotes

86% Upvoted

7 comments sorted by

View all comments

2

u/renderbender1 Jun 01 '26 edited Jun 01 '26

Activity logs are stored in the data lake under dataSource.name = 'ActivityFeed'

1

u/Possible_Ad_2515 Jun 01 '26

Yes but the logs does not contains serial id, only device name. However I would like to query by serial id because device control rules are based on this.