CmdID

CmdID / aws / aws iot

aws iot list-active-violations

The IoT Device Defender detect feature will no longer be available to new customers starting August 31, 2026. AWS CLI reference

1 example 7 options Its page in the AWS CLI reference

Opens CmdID with your command. It is read in your browser and sent nowhere.

Examples

from aws-cli, each command read by CmdID

To list the active violations

The following list-active-violations example lists all violations for the specified security profile.

aws iot list-active-violations --security-profile-name TestprofileIdentify
--security-profile-nameThe name of the Device Defender security profile for which violations are listed.
Its output, shortened
{
    "activeViolations": [
        {
            "violationId": "174db59167fa474c80a652ad1583fd44",
            "thingName": "iotconsole-1560269126751-1",
            "securityProfileName": "Testprofile",
            "behavior": {
                "name": "Authorization",
                "metric": "aws:num-authorization-failures",
                "criteria": {
                    "comparisonOperator": "greater-than",
                    "value": {
                        "count": 10
                    },
                    "durationSeconds": 300,
                    "consecutiveDatapointsToAlarm": 1,
                    "consecutiveDatapointsToClear": 1
                }
            },
            "lastViolationValue": {
                "count": 0
            },
            "lastViolationTime": 1560293700.0,
            "violationStartTime": 1560279000.0
        },
        {
            "violationId": "c8a9466a093d3b7b35cd44ca58bdbeab",
            "thingName": "TvnQoEoU",
            "securityProfileName": "Testprofile",
            "behavior": {
… 65 more lines

For more information, see Detect in the AWS IoT Device Defender Developer Guide.

Options

7 in the AWS CLI reference
--behavior-criteria-typeThe criteria for a behavior.
--list-suppressed-alertsA list of all suppressed alerts.
--max-resultsThe maximum number of results to return at one time.
--next-tokenThe token for the next set of results.
--security-profile-nameThe name of the Device Defender security profile for which violations are listed.
--thing-nameThe name of the thing whose active violations are listed.
--verification-stateThe verification state of the violation (detect alarm).