Lists the Device Defender security profile violations discovered during the given time period. You can use filters to limit the results to those alerts issued for a particular security profile, behavior, or thing (device).
Requires permission to access the ListViolationEvents action.
get/violation-events#startTime&endTime
Query parameters
startTimestring date-time required
The start time for the alerts to be listed.
endTimestring date-time required
The end time for the alerts to be listed.
thingNamestring
A filter to limit results to those alerts caused by the specified thing.
securityProfileNamestring
A filter to limit results to those alerts generated by the specified security profile.
behaviorCriteriaType'STATIC' | 'STATISTICAL' | 'MACHINE_LEARNING'
The criteria for a behavior.
listSuppressedAlertsboolean
A list of all suppressed alerts.
verificationState'FALSE_POSITIVE' | 'BENIGN_POSITIVE' | 'TRUE_POSITIVE' | 'UNKNOWN'
The verification state of the violation (detect alarm).
nextTokenstring
The token for the next set of results.
maxResultsinteger
The maximum number of results to return at one time.
Response
Success