The Violations page is where you review activity that was blocked or flagged by your Content Filter policies. It summarizes totals at the top, provides a detailed filter panel, and lists individual violations in a sortable, paginated table that you can export.
What this guide covers
Before you begin: open the Content Filter console and select Violations from the top navigation. The page shows summary counts, a Filter panel, and the results table below.
The Violations page: summary metrics, the Filter panel, result tabs, and the violations table.
Summary metrics
Two counts sit at the top of the page. Total Violations is the all-time count for the current domain, and Recent Violations (past 24 hours) shows how many occurred in the last day. Use the Refresh control at the top right to reload the latest figures.
The Total Violations and Recent Violations (past 24 hours) counts at the top of the page.
Filtering violations
The Filter panel narrows the results. Set the criteria you need, then select Search; use Reset to clear them. The Violations Only toggle limits results to blocked/flagged activity rather than all activity.
The Filter panel: Date Range, Url, Organizational Unit, Input, Email, Policy Type, Device Ip, Risk(s) and the Violations Only toggle.
Filter | Description |
Date Range | Start and end date/time bounding the results. |
Url | Filter by the URL involved in the violation. |
Organizational Unit | Limit to a specific OU. |
Input | Filter by the input/term involved. |
Filter by the user’s email address. | |
Policy Type | Any, Blocklist, YouTube, or Risk. |
Device Ip | Filter by the device IP address. |
Risk(s) | Filter by one or more configured risks. |
Violations Only | When on, shows only blocked/flagged activity. |
Result tabs and exporting
Above the table, result tabs let you focus on a category of activity: All, Url, Input, Search, and AI. The Reports button exports the current results, and the page size and Previous / Next controls handle pagination.
Export option | Description |
CSV | Download the results as a CSV file. |
Download the results as a PDF file. | |
Scheduled Report | Set up a recurring report of these results. |
Reading the violations table
Each row is a single violation. The table scrolls horizontally to reveal all columns; the Date column is sortable. The View action in each row opens a Context view with more detail about that violation.
The violations table showing Email, Date, Url, Input, Risks and External Ip.
Scrolling right reveals Internal Ip, Device and Class, plus the row View action.
Column | Description |
The user associated with the violation. | |
Date | When the violation occurred (sortable). |
Url | The web address involved. |
Input | The input/term involved, or N/A. |
Risks | The policy type or risk that triggered it (e.g. Blocklist). |
External Ip | The public IP address of the device. |
Internal Ip | The internal/private IP, or N/A. |
Device | The device identifier. |
Class | The associated class, if any. |
Actions | View opens the Context detail for the violation. |
Related guides
Overview – Policy Block List
Overview – Policy Risks
Overview – Policy YouTube
Overview – Devices
Overview – Scheduled Reports