You can now list misconfigured SIEM log sources through the API, with the same data shown on the Misconfigured Sources tab in the portal. Each record includes the agent ID, hostname, organization, status (unresolved or resolving), and the full required audit policy (category, name, success/failure), so you can see exactly what needs to change. Results are paginated and can be filtered by organization_id.