Get-XdrAdvancedHuntingFunction
SYNOPSIS
Retrieves Advanced Hunting functions from Microsoft Defender XDR.
SYNTAX
Get-XdrAdvancedHuntingFunction [[-Id] <Int32>] [-Force] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
DESCRIPTION
Gets saved functions for Advanced Hunting queries in Microsoft Defender XDR. Functions can be filtered by ID or retrieved all at once. This function includes caching support with a 30-minute TTL to reduce API calls.
EXAMPLES
EXAMPLE 1
Get-XdrAdvancedHuntingFunction
Retrieves all Advanced Hunting functions using cached data if available.
EXAMPLE 2
Get-XdrAdvancedHuntingFunction -Force
Forces a fresh retrieval of all functions, bypassing the cache.
EXAMPLE 3
Get-XdrAdvancedHuntingFunction -Id 6
Retrieves a specific function by ID.
EXAMPLE 4
Get-XdrAdvancedHuntingFunction | Where-Object $_.IsShared -eq $true
Retrieves only shared functions.
EXAMPLE 5
Get-XdrAdvancedHuntingFunction | Where-Object $_.Path -like "MyFolder*"
Retrieves functions in a specific folder path.
PARAMETERS
-Id
Optional ID of a specific function to retrieve. If not specified, all functions will be returned.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 1
Default value: 0
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.