Skip to main content

Get-XdrConfigurationCriticalAssetManagementClassificationSchema

SYNOPSIS​

Retrieves the schema for Critical Asset Management rules from Microsoft Defender XDR.

SYNTAX​

Get-XdrConfigurationCriticalAssetManagementClassificationSchema [[-AssetType] <String>] [-Force]
 [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Gets the schema definition for the Critical Asset Management query builder. This includes the available asset types (Devices, Identities, CloudResources) and their filterable properties that can be used when creating custom critical asset rules.

Each property includes its name and type (e.g., ClosedList, Boolean, String, Array). This information is useful for understanding what criteria can be used to identify critical assets in your organization.

EXAMPLES​

EXAMPLE 1​

Get-XdrConfigurationCriticalAssetManagementClassificationSchema
Retrieves the full schema for all asset types.

EXAMPLE 2​

Get-XdrConfigurationCriticalAssetManagementClassificationSchema -AssetType Identities
Retrieves only the schema for identity-based rules.

EXAMPLE 3​

Get-XdrConfigurationCriticalAssetManagementClassificationSchema -AssetType Devices |
    Select-Object -ExpandProperty properties
Lists all available properties for device-based critical asset rules.

EXAMPLE 4​

Get-XdrConfigurationCriticalAssetManagementClassificationSchema -Force
Forces a fresh retrieval of the schema, bypassing the cache.

EXAMPLE 5​

# Discover schema and create a rule based on available properties
$deviceProps = Get-XdrConfigurationCriticalAssetManagementClassificationSchema -AssetType Devices |
    Select-Object -ExpandProperty properties

Display available properties

$deviceProps | Format-Table name, propertyType

Create a rule using one of the discovered properties

New-XdrConfigurationCriticalAssetManagementClassification ` -RuleName "Critical Servers" ` -RuleDescription "Servers with critical tag" ` -AssetType Devices ` -CriticalityLevel VeryHigh ` -Property "Tags" ` -Operator Contains ` -Value "Critical"

Discovers available properties and creates a rule using one of them.

PARAMETERS​

-AssetType​

Filter the schema to a specific asset type. Valid values are:

  • Devices: Properties for device-based rules
  • Identities: Properties for identity/user-based rules
  • CloudResources: Properties for cloud resource-based rules
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Force​

Bypasses the cache and forces a fresh retrieval from the API.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

PSCustomObject[]​

Returns an array of asset type schemas, each containing:​

- assetType: The type of asset (Devices, Identities, CloudResources)​

- properties: An array of property definitions with name and propertyType​

NOTES​

Property types include:

  • ClosedList: Enumerated values (dropdown selection)
  • ClosedListAsArray: Multiple enumerated values
  • ClosedListAsJson: JSON-based enumerated values
  • Boolean: True/False values
  • String: Free-text values
  • Array: Multiple free-text values
  • DeviceEntity: Device name lookup
  • UserEntity: User/account name lookup