Export-XdrToSentinel
SYNOPSIS
Exports XDR data to a Microsoft Sentinel (Log Analytics) custom table.
SYNTAX
Export-XdrToSentinel [-Data] <Object> [-LogType] <String> [[-TimestampField] <String>] [[-BatchSize] <Int32>]
[-PassThru] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Sends data to a Log Analytics workspace using the HTTP Data Collector API. Data appears in the workspace as a custom log table with the "_CL" suffix.
Requires Set-XdrSentinelConnection to be called first with workspace credentials.
Accepts pipeline input from any XDRInternals Get-* cmdlet or any PowerShell object array. Objects are serialized to JSON and posted in batches (max 30 MB per batch).
EXAMPLES
EXAMPLE 1
Get-XdrSuppressionRule | Export-XdrToSentinel -LogType "XdrSuppressionRules"
Exports all suppression rules to the XdrSuppressionRules_CL table.
EXAMPLE 2
Get-XdrEndpointAdvancedFeatures | Export-XdrToSentinel -LogType "XdrAdvancedFeatures"
EXAMPLE 3
Get-XdrAlert -Top 100 | Export-XdrToSentinel -LogType "XdrAlerts" -TimestampField "CreationTime" -PassThru | Format-Table
Exports alerts and also passes them through for display.
EXAMPLE 4
$devices = Get-XdrEndpointDevice
Export-XdrToSentinel -Data $devices -LogType "XdrDevices"
PARAMETERS
-Data
The data to export. Accepts pipeline input or an explicit array of objects.
Type: Object
Parameter Sets: (All)
Aliases:
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False
-LogType
The custom log type name. This becomes the table name in Log Analytics with "_CL" appended. Example: "XdrSuppressionRules" becomes "XdrSuppressionRules_CL". Must contain only letters, numbers, and underscores, max 100 characters.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-TimestampField
Optional field name in the data that contains a timestamp. If specified, Log Analytics uses this as the TimeGenerated field instead of ingestion time.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 3
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-BatchSize
Maximum number of records per API call. Defaults to 500.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 4
Default value: 500
Accept pipeline input: False
Accept wildcard characters: False
-PassThru
When specified, outputs the original data to the pipeline after exporting.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.