Export-XdrAzureDataExplorer
SYNOPSIS
Exports pipeline data to Azure Data Explorer using queued ingestion.
SYNTAX
ManualTable (Default)
Export-XdrAzureDataExplorer -Data <Object> -TableName <String> [-MappingName <String>] [-MaxBlobSizeMB <Int32>]
[-TempPath <String>] [-KeepTempFiles] [-SkipBootstrap] [-DisableCompression] [-TrackIngestion]
[-WaitForIngestion] [-WaitTimeoutMinutes <Int32>] [-StatusPollingIntervalSeconds <Int32>] [-PassThru]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
TypedSource
Export-XdrAzureDataExplorer -Data <Object> [-TableName <String>] -Source <String> [-MaxBlobSizeMB <Int32>]
[-TempPath <String>] [-KeepTempFiles] [-SkipBootstrap] [-DisableCompression] [-TrackIngestion]
[-WaitForIngestion] [-WaitTimeoutMinutes <Int32>] [-StatusPollingIntervalSeconds <Int32>] [-PassThru]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Accepts pipeline input, stages records as newline-delimited JSON, compresses the staged files with gzip, uploads them to the Azure Data Explorer-managed staging container, and submits queued-ingestion requests.
When used with -TableName alone, the cmdlet uses a raw-table pattern with a single Event:dynamic column. When used with -Source, the cmdlet automatically routes events to typed tables based on their ActionType or SourceTable, creating typed schemas with the appropriate column definitions and JSON ingestion mappings.
Queued ingestion is asynchronous. After this cmdlet uploads blobs and submits ingestion requests, Azure Data Explorer may still take several minutes before the data is queryable. Use -TrackIngestion together with Get-XdrAzureDataExplorerIngestionStatus, or use -WaitForIngestion when you want the cmdlet to wait for queued ingestion to finish.
If a later batch or pipeline stage fails, queued batches that were already submitted cannot be rolled back. Pipeline cancellation closes local writers and removes staging files without uploading or submitting the buffered, unclosed batch.
Requires Set-XdrAzureDataExplorerConnection to be called first.
EXAMPLES
EXAMPLE 1
Set-XdrAzureDataExplorerConnection -ClusterUri "https://mycluster.westeurope.kusto.windows.net" -Database "Investigations"
Get-XdrEndpointDeviceTimeline -DeviceId "2bec169acc9def3ebd0bf8cdcbd9d16eb37e50e2" | Export-XdrAzureDataExplorer -TableName "DeviceTimeline"
Exports a device timeline to Azure Data Explorer using queued ingestion with a single dynamic table.
EXAMPLE 2
Get-XdrIdentityUser -Upn "user@contoso.com" | Get-XdrIdentityUserTimeline -LastNDays 30 | Export-XdrAzureDataExplorer -TableName "IdentityTimeline" -PassThru
Queues identity timeline data for ingestion and also passes the records through the pipeline.
EXAMPLE 3
Get-XdrEndpointDeviceTimeline -DeviceId "2bec169acc9def3ebd0bf8cdcbd9d16eb37e50e2" -LastNDays 7 | Export-XdrAzureDataExplorer -TableName "DeviceTimeline" -TrackIngestion -Verbose
Queues device timeline data for ingestion and asks ADX to return queued-ingestion operation IDs.
EXAMPLE 4
Get-XdrEndpointDeviceTimeline -DeviceId "2bec169acc9def3ebd0bf8cdcbd9d16eb37e50e2" -LastNDays 7 | Export-XdrAzureDataExplorer -TableName "DeviceTimeline" -WaitForIngestion -Verbose
Queues a device timeline export and waits until the queued-ingestion operations finish.
EXAMPLE 5
Get-XdrEndpointDeviceTimeline -DeviceId "2bec169acc9def3ebd0bf8cdcbd9d16eb37e50e2" -LastNDays 7 | Export-XdrAzureDataExplorer -Source DeviceTimeline -Verbose
Exports a device timeline using typed table routing. Events are automatically split across tables like XDRDeviceTimelineProcessEvents, XDRDeviceTimelineNetworkEvents, etc. based on their ActionType.
EXAMPLE 6
Get-XdrEndpointDeviceTimeline -DeviceId "2bec169acc9def3ebd0bf8cdcbd9d16eb37e50e2" -LastNDays 7 | Export-XdrAzureDataExplorer -Source DeviceTimeline -TableName "DeviceTimelineFallback" -WaitForIngestion -Verbose
Exports a device timeline using typed table routing with a fallback table for unrecognized event types, and waits for all queued ingestion operations to complete.
PARAMETERS
-Data
The objects to export. Accepts pipeline input.
Type: Object
Parameter Sets: (All)
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False
-TableName
The target Azure Data Explorer table name. Mandatory when -Source is not specified. When -Source is specified, -TableName is optional and serves as a fallback table for events that don't match any typed table profile.
Type: String
Parameter Sets: ManualTable
Aliases: Table
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Type: String
Parameter Sets: TypedSource
Aliases: Table
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Source
Enables typed table routing. Events are automatically routed to the appropriate typed ADX table based on their ActionType or SourceTable. Each unique table gets its own staging file, blob upload, and ingestion submission.
Type: String
Parameter Sets: TypedSource
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-MappingName
Optional mapping name. Defaults to <TableName>_EventMapping. Only valid when -Source is not specified.
Type: String
Parameter Sets: ManualTable
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-MaxBlobSizeMB
Maximum uncompressed staging size, in MB, before the cmdlet rolls over to a new blob. The value is capped by the service's reported queued-ingestion maxDataSize.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 1024
Accept pipeline input: False
Accept wildcard characters: False
-TempPath
Optional root path for temporary staging files.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-KeepTempFiles
Keeps temporary staging files instead of deleting them after upload.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-SkipBootstrap
Skips the create-if-missing table and mapping bootstrap logic.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-DisableCompression
Disables gzip compression for uploaded staging files.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-TrackIngestion
Requests ADX ingestion operation IDs for each queued ingestion request. Leave this disabled for high-volume exports unless you specifically need per-request tracking.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-WaitForIngestion
Waits for all queued ingestion requests submitted by this invocation to finish. This automatically enables tracking for the current export.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-WaitTimeoutMinutes
Maximum number of minutes to wait when -WaitForIngestion is specified.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 30
Accept pipeline input: False
Accept wildcard characters: False
-StatusPollingIntervalSeconds
Number of seconds between ingestion-status polls when -WaitForIngestion is specified.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 15
Accept pipeline input: False
Accept wildcard characters: False
-PassThru
Outputs the original input objects after staging them for ingestion.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
INPUTS
OUTPUTS
NOTES
AUTHENTICATION: This cmdlet requires a separate Azure Data Explorer token, independent of your XDR portal session. The token is acquired automatically with the following priority: explicit token > Az.Accounts/Azure CLI for ADX resources > ESTS CLI bridge > Managed Identity.
Connect-XdrBySSO and Set-XdrConnection (with raw sccauth/xsrf tokens) do NOT capture ESTS cookies, so the silent CLI bridge is unavailable. When using these methods, ensure you have an active Connect-AzAccount or az login session, or provide an explicit -AccessToken on Set-XdrAzureDataExplorerConnection.