Get-XdrConfigurationCriticalAssetManagementClassification
SYNOPSIS
Retrieves critical asset management classification rules from Microsoft Defender XDR.
SYNTAX
Get-XdrConfigurationCriticalAssetManagementClassification [[-RuleId] <String>] [[-RuleType] <String>]
[[-Enabled] <Boolean>] [-IncludeAffectedAssets] [-Force] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
DESCRIPTION
Gets the critical asset management rules from the Microsoft Defender XDR portal, including asset classification rules and conditions. This function includes caching support with a 30-minute TTL to reduce API calls.
Critical asset management allows you to define classification rules that identify high-value assets in your organization, such as privileged accounts, critical servers, or sensitive data repositories.
EXAMPLES
EXAMPLE 1
Get-XdrConfigurationCriticalAssetManagementClassification
Retrieves all critical asset management rules using cached data if available.
EXAMPLE 2
Get-XdrConfigurationCriticalAssetManagementClassification -RuleId "55a3f458c38a4b53b7d6a5564e0d1ac7"
Retrieves a specific critical asset management rule by its ID.
EXAMPLE 3
Get-XdrConfigurationCriticalAssetManagementClassification -RuleType Predefined
Retrieves only predefined critical asset management rules.
EXAMPLE 4
Get-XdrConfigurationCriticalAssetManagementClassification -RuleType CreatedByUser
Retrieves only user-created critical asset management rules.
EXAMPLE 5
Get-XdrConfigurationCriticalAssetManagementClassification -Enabled $true
Retrieves only enabled critical asset management rules.
EXAMPLE 6
Get-XdrConfigurationCriticalAssetManagementClassification -RuleType Predefined -Enabled $false
Retrieves predefined rules that are currently disabled.
EXAMPLE 7
Get-XdrConfigurationCriticalAssetManagementClassification -Force
Forces a fresh retrieval of the critical asset management configuration, bypassing the cache.
EXAMPLE 8
Get-XdrConfigurationCriticalAssetManagementClassification -RuleId "b65d8e2e4e2f496d975a3987e43811f8" -IncludeAffectedAssets
Retrieves a specific rule and includes the list of affected assets.
EXAMPLE 9
Get-XdrConfigurationCriticalAssetManagementClassification -RuleType Predefined -IncludeAffectedAssets | Where-Object $_.affectedAssetsCount -gt 0
Retrieves predefined rules that have affected assets and includes the asset details.
EXAMPLE 10
# Pipeline to Set: Enable all disabled predefined rules
Get-XdrConfigurationCriticalAssetManagementClassification -RuleType Predefined -Enabled $false |
Set-XdrConfigurationCriticalAssetManagementClassification -Enabled $true
Enables all disabled predefined critical asset management rules.
EXAMPLE 11
# Pipeline to Remove: Clean up test rules
Get-XdrConfigurationCriticalAssetManagementClassification -RuleType CreatedByUser |
Where-Object $_.ruleName -like "*Test*" |
Remove-XdrConfigurationCriticalAssetManagementClassification -Force
Removes all user-created rules with "Test" in the name.
PARAMETERS
-RuleId
The unique identifier of a specific rule to retrieve. If specified, returns only the rule with the matching ID.
Type: String
Parameter Sets: (All)
Aliases: id
Required: False
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-RuleType
Filters rules by type. Valid values are "Predefined" and "CreatedByUser". If not specified, all rules are returned.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Enabled
Filters rules by enabled status. When specified, returns only rules where isEnabled matches the specified value.
Type: Boolean
Parameter Sets: (All)
Aliases:
Required: False
Position: 3
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-IncludeAffectedAssets
When specified, retrieves the list of affected assets for each rule by making additional API calls to the querybuilder/assets endpoint. This adds an 'affectedAssets' property to each rule containing the detailed asset information.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.