![\"\"](\"https:\/\/zecurit.com\/help\/wp-content\/uploads\/2026\/08\/image-2-1024x622.png\")
<\/figure>\n\n\n\n- \n
- Log in to the Zecurit portal<\/strong>.<\/li>\n\n\n\n
- Go to Endpoint Manager \u2192 Application Control<\/strong>.<\/li>\n\n\n\n
- Select the Violations<\/strong> tab, alongside Application Group and Deployment.<\/li>\n<\/ol>\n\n\n\n
The Violations tab requires no additional setup. It automatically populates once any deployment policy is published and begins enforcing.<\/p>\n\n\n\n
Summary Metrics<\/h2>\n\n\n\n
Three summary cards appear at the top of the page, reflecting the currently selected time range:<\/p>\n\n\n\n
Metric<\/strong><\/th> Description<\/strong><\/th><\/tr><\/thead> Violations in last 7 days<\/td> Total count of all logged enforcement events in the period<\/td><\/tr> Unique Devices Affected<\/td> Number of distinct devices that generated at least one violation<\/td><\/tr> Policies Triggered<\/td> Number of distinct deployment policies that fired at least once<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n These metrics give a fast health check: a high violation count concentrated on very few devices often points to a misbehaving application or a misconfigured policy, rather than widespread risky behavior.<\/p>\n\n\n\n
Violations Table Columns<\/h2>\n\n\n\n
Column<\/strong><\/th> Description<\/strong><\/th><\/tr><\/thead> Device<\/td> Hostname of the endpoint where the event occurred<\/td><\/tr> User<\/td> User account context under which the application attempted to run (e.g., SYSTEM)<\/td><\/tr> Application<\/td> Name of the application involved (e.g., Microsoft Edge, Google Chrome)<\/td><\/tr> Application Version<\/td> Detected version of the application, or “Unknown” if not captured<\/td><\/tr> Group<\/td> The application group whose rule matched (e.g., Edge, chrome)<\/td><\/tr> Policy<\/td> The specific deployment policy that triggered enforcement (e.g., edge, chrome)<\/td><\/tr> Reported Time<\/td> Timestamp the event was reported to the portal<\/td><\/tr> Action Taken<\/td> The enforcement outcome (e.g., Blocked)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Filtering and Searching<\/h2>\n\n\n\n
The toolbar above the table provides several ways to narrow results:<\/p>\n\n\n\n
Control<\/strong><\/th> Function<\/strong><\/th><\/tr><\/thead> Search icon<\/td> Search violations by device, user, or application name<\/td><\/tr> Share icon<\/td> Export or share the current filtered view with other stakeholders<\/td><\/tr> List\/view icon<\/td> Toggle between table and alternate display views<\/td><\/tr> Date range dropdown (e.g., “All Days”)<\/td> Restrict results to a specific time window<\/td><\/tr> Filter icon<\/td> Apply advanced filters, such as by Group, Policy, or Action Taken<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Narrowing by date range and policy is especially useful when validating a newly published policy, since it isolates only the events that policy generated.<\/p>\n\n\n\n
Reading a Violation Record<\/h2>\n\n\n\n
A single violation row tells a complete story of one enforcement event. For example:<\/p>\n\n\n\n
Device Ken, running as user SYSTEM, attempted to launch Microsoft Edge. This matched the Edge application group via the edge policy, was reported at 11:10:38 AM, and the action taken was Blocked.<\/p>\n\n\n\n
Repeated identical rows for the same device and application typically indicate either a background or auto-launch process retrying repeatedly, or a user repeatedly attempting to open a blocked application.<\/p>\n\n\n\n
Example Violation Entries<\/h2>\n\n\n\n
Device<\/strong><\/th> Application<\/strong><\/th> Group<\/strong><\/th> Policy<\/strong><\/th> Action Taken<\/strong><\/th><\/tr><\/thead> Ken<\/td> Microsoft Edge<\/td> Edge<\/td> edge<\/td> Blocked<\/td><\/tr> Alex<\/td> Google Chrome<\/td> chrome<\/td> chrome<\/td> Blocked<\/td><\/tr> Surya<\/td> Google Chrome<\/td> chrome<\/td> chrome<\/td> Blocked<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Responding to Violations<\/h2>\n\n\n\n
Observation<\/strong><\/th> Suggested Response<\/strong><\/th><\/tr><\/thead> High volume of violations from one device<\/td> Investigate the device for repeated auto-launch behavior (e.g., a startup item relaunching a blocked browser)<\/td><\/tr> Violations for a business-critical application<\/td> Reassess whether the application group or policy scope is too broad, and add an exception if needed<\/td><\/tr> Violations concentrated on one user account<\/td> Reach out to the user or their manager to confirm intended use and provide guidance<\/td><\/tr> Sudden spike in violations for a new application<\/td> Confirm whether a new application group or policy was recently published, or investigate as a potential new risk<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Best Practices<\/h2>\n\n\n\n
- \n
- Check the Violations tab shortly after publishing any new policy to confirm it’s behaving as expected.<\/li>\n\n\n\n
- Use the date range and policy filters to isolate noise from a single misconfigured rule.<\/li>\n\n\n\n
- Periodically review high-frequency violations for patterns that suggest a policy needs an exception rather than a user needing correction.<\/li>\n\n\n\n
- Export violation data regularly if your organization requires audit trails for compliance reporting.<\/li>\n<\/ul>\n\n\n\n
Troubleshooting Tips<\/h2>\n\n\n\n
Issue<\/strong><\/th> Resolution<\/strong><\/th><\/tr><\/thead> No violations appearing despite a published policy<\/td> Confirm the target scope includes the devices being tested, and that the Enforcement Action isn’t set to a non-logging state<\/td><\/tr> Application Version shows “Unknown”<\/td> This is expected when the agent cannot read version metadata from the executable; matching still functions via other rule data<\/td><\/tr> Too many duplicate rows for the same event<\/td> Check whether the blocked application is configured to auto-relaunch, generating repeated attempts<\/td><\/tr> Can’t find a specific violation<\/td> Widen the date range filter, or search directly by device or application name<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n <\/p>\n","protected":false},"featured_media":0,"parent":3309,"menu_order":2,"comment_status":"open","ping_status":"closed","template":"","meta":{"_is_vendor_doc":"0","footnotes":""},"doc_tag":[],"class_list":["post-3322","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/comments?post=3322"}],"version-history":[{"count":5,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3322\/revisions"}],"predecessor-version":[{"id":3354,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3322\/revisions\/3354"}],"up":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3309"}],"prev":[{"title":"Creating a Deployment Policy in Application Control","link":"https:\/\/zecurit.com\/help\/endpoint-management\/application-control\/deploying-the-policy\/","href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3319"}],"wp:attachment":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/media?parent=3322"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/doc_tag?post=3322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Go to Endpoint Manager \u2192 Application Control<\/strong>.<\/li>\n\n\n\n