Get-XdrAlert
SYNOPSIS
Retrieves alerts from Microsoft Defender XDR.
SYNTAX
Paged (Default)
Get-XdrAlert [-DaysAgo <Int32>] [-Order <String>] [-PageNumber <Int32>] [-PageSize <Int32>]
[-Severity <String[]>] [-Status <String[]>] [-ProgressAction <ActionPreference>] [<CommonParameters>]
All
Get-XdrAlert [-DaysAgo <Int32>] [-Order <String>] [-PageSize <Int32>] [-Severity <String[]>]
[-Status <String[]>] [-All] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets alerts from Microsoft Defender XDR with support for filtering by time range and pagination. Alerts can be retrieved with automatic pagination using the -All parameter or with manual page control.
EXAMPLES
EXAMPLE 1
Get-XdrAlert
Retrieves the first page of alerts from the last 7 days, sorted by newest first.
EXAMPLE 2
Get-XdrAlert -DaysAgo 30
Retrieves alerts from the last 30 days.
EXAMPLE 3
Get-XdrAlert -Order asc
Retrieves alerts sorted by oldest first.
EXAMPLE 4
Get-XdrAlert -PageNumber 2 -PageSize 100
Retrieves the second page with 100 alerts per page.
EXAMPLE 5
Get-XdrAlert -All
Automatically retrieves all alerts from the last 7 days across all pages.
EXAMPLE 6
Get-XdrAlert -DaysAgo 14 -All
Retrieves all alerts from the last 14 days with automatic pagination.
EXAMPLE 7
Get-XdrAlert -Severity High, Medium
Retrieves only high and medium severity alerts from the last 7 days.
EXAMPLE 8
Get-XdrAlert -Status New, InProgress
Retrieves only new and in-progress alerts.
EXAMPLE 9
Get-XdrAlert -Severity High -Status New -DaysAgo 30
Retrieves high severity new alerts from the last 30 days.
EXAMPLE 10
Get-XdrAlert | Where-Object $_.severity -eq "High"
Retrieves alerts and filters for high severity only.
PARAMETERS
-DaysAgo
Number of days to look back for alerts. Default is 7 days.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 7
Accept pipeline input: False
Accept wildcard characters: False
-Order
Sort order for results. Valid values are "desc" (descending, newest first) or "asc" (ascending, oldest first). Default is "desc".
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: Desc
Accept pipeline input: False
Accept wildcard characters: False
-PageNumber
Specific page number to retrieve. Cannot be used with -All parameter. Default is 1.
Type: Int32
Parameter Sets: Paged
Aliases:
Required: False
Position: Named
Default value: 1
Accept pipeline input: False
Accept wildcard characters: False
-PageSize
Number of alerts to retrieve per page. Default is 60. Maximum value depends on API limits.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 60
Accept pipeline input: False
Accept wildcard characters: False
-Severity
Filter alerts by severity. Valid values are "Informational", "Low", "Medium", "High". Multiple values can be specified as an array.
Type: String[]
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Status
Filter alerts by status. Valid values are "New", "InProgress", "Resolved". Multiple values can be specified as an array.
Type: String[]
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-All
Automatically retrieves all pages of alerts for the specified time range. Cannot be used with -PageNumber parameter.
Type: SwitchParameter
Parameter Sets: All
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.