Log APM Ending Item

I have an access policy for ActiveSync that does a cert check. Due to a problem we had with our MDM program, certs were not renewed, I had to temporarily allow expired certs to pass through the access policy. Now I need to find all devices that have an expired cert.

I am logging ssl.cert.valid, so I can find devices that return "10" for expired cert. I also want to check the policy for fallback on the client cert check.

Is there a variable or mcget command to find the APM policy ending item?