Get-XdrCloudAppsActivityTimeline
SYNOPSIS
Retrieves Microsoft Defender for Cloud Apps activity timeline data.
SYNTAX
Default (Default)
Get-XdrCloudAppsActivityTimeline [-FromDate <DateTime>] [-ToDate <DateTime>] [-LastNDays <Int32>]
[-PageSize <Int32>] [-Filters <Hashtable>] [-IncludeThreatScores] [-ThrottleLimit <Int32>]
[-ChunkHours <Int32>] [-Aggressive] [-TimeoutSeconds <Int32>] [-MaxRetries <Int32>]
[-RetryDelaySeconds <Int32>] [-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles]
[-ExportPath <String>] [-ExportFormat <String>] [-PassThru] [-Compress] [-AllowPartial] [-Force]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
Metadata
Get-XdrCloudAppsActivityTimeline [-Metadata] [-Raw] [-Force] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
ArchivedMetadata
Get-XdrCloudAppsActivityTimeline [-ArchivedMetadata] [-Raw] [-Force] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
CountOnly
Get-XdrCloudAppsActivityTimeline [-CountOnly] [-FromDate <DateTime>] [-ToDate <DateTime>] [-LastNDays <Int32>]
[-Filters <Hashtable>] [-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-Force]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Retrieves Cloud Apps activity events with reliable chunking, retry handling, recent/archived API routing, export support, and typed admin-friendly output.
EXAMPLES
EXAMPLE 1
Get-XdrCloudAppsActivityTimeline -LastNDays 1
Retrieves the last day of Cloud Apps activity.
EXAMPLE 2
Get-XdrCloudAppsActivityTimeline -LastNDays 7 -Aggressive -ExportPath .\cloud-apps-activity.json
Retrieves seven days of activity using aggressive incident response settings and exports to JSON.
PARAMETERS
-Metadata
Returns filter metadata for the recent activities API.
Type: SwitchParameter
Parameter Sets: Metadata
Aliases:
Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ArchivedMetadata
Returns filter metadata for the archived activities API.
Type: SwitchParameter
Parameter Sets: ArchivedMetadata
Aliases:
Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-Raw
Returns raw API metadata or response data when supported.
Type: SwitchParameter
Parameter Sets: Metadata, ArchivedMetadata
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-CountOnly
Returns activity counts without retrieving full activity records.
Type: SwitchParameter
Parameter Sets: CountOnly
Aliases:
Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-FromDate
Start of the timeline range.
Type: DateTime
Parameter Sets: Default, CountOnly
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ToDate
End of the timeline range.
Type: DateTime
Parameter Sets: Default, CountOnly
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-LastNDays
Retrieves activity from the last specified number of days.
Type: Int32
Parameter Sets: Default, CountOnly
Aliases:
Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
-PageSize
Number of activities to request per page.
Type: Int32
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: 250
Accept pipeline input: False
Accept wildcard characters: False
-Filters
Cloud Apps activity filters to include in the query body.
Type: Hashtable
Parameter Sets: Default, CountOnly
Aliases:
Required: False
Position: Named
Default value: @
Accept pipeline input: False
Accept wildcard characters: False
-IncludeThreatScores
Adds threat score data for recent activities when available.
Type: SwitchParameter
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ThrottleLimit
Maximum number of chunks to retrieve concurrently.
Type: Int32
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: 8
Accept pipeline input: False
Accept wildcard characters: False
-ChunkHours
Maximum hours represented by each activity chunk.
Type: Int32
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: 6
Accept pipeline input: False
Accept wildcard characters: False
-Aggressive
Uses higher concurrency and smaller chunks for incident response investigations.
Type: SwitchParameter
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-TimeoutSeconds
Maximum total runtime for chunk retrieval.
Type: Int32
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: 3600
Accept pipeline input: False
Accept wildcard characters: False
-MaxRetries
Maximum retry attempts for each page request.
Type: Int32
Parameter Sets: Default, CountOnly
Aliases:
Required: False
Position: Named
Default value: 5
Accept pipeline input: False
Accept wildcard characters: False
-RetryDelaySeconds
Base delay used for retry backoff.
Type: Int32
Parameter Sets: Default, CountOnly
Aliases:
Required: False
Position: Named
Default value: 5
Accept pipeline input: False
Accept wildcard characters: False
-RequestTimeoutSeconds
Timeout for each individual HTTP request.
Type: Int32
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: 60
Accept pipeline input: False
Accept wildcard characters: False
-OutputPath
Directory used for temporary chunk files.
Type: String
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-KeepTempFiles
Keeps temporary chunk files after the command completes.
Type: SwitchParameter
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ExportPath
Writes retrieved activity events to a JSON file.
Type: String
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ExportFormat
Export file format. Json preserves the existing array output; Ndjson streams one event per line and is preferred for large incident response exports.
Type: String
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: Json
Accept pipeline input: False
Accept wildcard characters: False
-PassThru
Returns activity events after writing ExportPath.
Type: SwitchParameter
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-Compress
Writes compressed JSON when ExportPath is used.
Type: SwitchParameter
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-AllowPartial
Returns completed chunks instead of terminating when one or more chunks fail.
Type: SwitchParameter
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-Force
Bypasses cache-backed metadata requests.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.