ConvertTo-XdrEncodedAdvancedHuntingQuery

SYNOPSIS

Encodes an Advanced Hunting query for use in Microsoft Defender XDR.

SYNTAX

ConvertTo-XdrEncodedAdvancedHuntingQuery [-QueryText] <String> [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

DESCRIPTION

Converts a KQL (Kusto Query Language) query into an encoded format that can be used in Microsoft Defender XDR Advanced Hunting. This is useful for generating shareable query links or for API operations that require encoded queries.

EXAMPLES

EXAMPLE 1

ConvertTo-XdrEncodedAdvancedHuntingQuery -QueryText "DeviceInfo | take 10"
Encodes a simple query to retrieve 10 device records.

EXAMPLE 2

$query = @"
ExposureGraphNodes
| where NodeLabel !in ("iam.user" ,"gcp-user", "user")
| where EntityIds has_any ("AzureResourceId","AwsResourceName","GcpFullResourceName")
| where isnotnull(NodeProperties.rawData.criticalityLevel)
"@
ConvertTo-XdrEncodedAdvancedHuntingQuery -QueryText $query
Encodes a multi-line query for exposure graph analysis.

EXAMPLE 3

Get-Content query.kql -Raw | ConvertTo-XdrEncodedAdvancedHuntingQuery
Encodes a query from a file using pipeline input.

PARAMETERS

-QueryText

The KQL query text to be encoded. This should be a valid Advanced Hunting query.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

String

Returns the encoded query string that can be used in URLs or API calls.

NOTES

This cmdlet requires an active session established via Connect-Xdr.

RELATED LINKS