---
title: "List Misconfigured SIEM Log Sources"
method: GET
path: "/v1/siem/log_sources/misconfigured"
tags: ["SIEM"]
---

# List Misconfigured SIEM Log Sources

`GET /v1/siem/log_sources/misconfigured`

## Request

- Base URL: `https://api.huntress.io`
- URL: `https://api.huntress.io/v1/siem/log_sources/misconfigured`
- Auth: `basic` (a scheme the document does not define)

Shows the misconfigured SIEM log sources associated with an account. For example, Windows endpoints whose audit policy was overwritten by a Group Policy.

This endpoint requires a [user-based API key](https://support.huntress.io/hc/en-us/articles/4416826761235-Generating-API-Keys) with the appropriate permissions to access this endpoint.

## Query parameters

- `limit` integer
- `page_token` string
- `organization_id` integer

## Response `200`

List Misconfigured SIEM Log Sources

- object
  - `misconfigured_log_sources` MisconfiguredLogSource[]
    - `agent_id` integer: A unique identifier for the agent behind this misconfigured log source.
    - `hostname` string: The hostname of the misconfigured endpoint.
    - `organization` unknown
    - `status` 'resolving' | 'unresolved': Whether the misconfiguration is being remediated. "unresolved" means it is active and not currently being remediated; "resolving" means remediation is in progress.
    - `misconfigured_policies` unknown[]: The policies that no longer match the Huntress-required audit configuration. Each entry names the policy and its category, and whether that policy requires "success" and/or "failure" auditing.
      - unknown
  - `pagination` Pagination: Pagination model
    - `next_page_url` string
    - `next_page_token` string

## Other responses

- `400`: Something about the request is malformed.
- `403`: There was an issue with your API credential or permissions.

## Changes

- **2026-10-29** `f593a257b4cc`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/huntress/apis/huntress-api-reference/changes/v1/siem/log_sources/misconfigured/get.md)

---

[API](https://skmtc.dev/huntress/apis/huntress-api-reference.md) - [All operations](https://skmtc.dev/huntress/apis/huntress-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/huntress/apis/huntress-api-reference/revisions/f593a257b4cc?raw)