Get-XdrEndpointConfigurationCustomCollectionRule
SYNOPSIS
Retrieves custom collection rules for Microsoft Defender for Endpoint.
SYNTAX
Get-XdrEndpointConfigurationCustomCollectionRule [[-Output] <String>] [-Force]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets the custom collection rules configured for Microsoft Defender for Endpoint. Custom collection rules allow you to collect specific file, registry, process, and network events based on defined criteria to support advanced hunting and detection scenarios. This function includes caching support with a 30-minute TTL to reduce API calls.
It incorporates the same YAML schema as used by Telemetry Collection Manager https://github.com/FalconForceTeam/TelemetryCollectionManager for easy export and version control of custom collection rules.
EXAMPLES
EXAMPLE 1
Get-XdrEndpointConfigurationCustomCollectionRule
Retrieves all custom collection rules using cached data if available.
EXAMPLE 2
Get-XdrEndpointConfigurationCustomCollectionRule -Force
Forces a fresh retrieval of custom collection rules, bypassing the cache.
EXAMPLE 3
Get-XdrEndpointConfigurationCustomCollectionRule | Where-Object $_.isEnabled -eq $true
Retrieves only enabled custom collection rules.
EXAMPLE 4
Get-XdrEndpointConfigurationCustomCollectionRule |
Where-Object $_.table -eq "DeviceFileEvents" |
Format-Table ruleName, actionType, platform, isEnabled -AutoSize
Retrieves custom collection rules for file events and displays them in a table.
EXAMPLE 5
$rules = Get-XdrEndpointConfigurationCustomCollectionRule
$rules | Where-Object $_.createdBy -eq "admin@contoso.com"
Retrieves all rules created by a specific user.
EXAMPLE 6
Get-XdrEndpointConfigurationCustomCollectionRule |
Select-Object ruleName, table, actionType, scope, isEnabled
Retrieves custom collection rules and displays key properties.
EXAMPLE 7
Get-XdrEndpointConfigurationCustomCollectionRule -Output YAML
Retrieves custom collection rules in YAML format for export.
YAML format is intended to use with https://github.com/FalconForceTeam/TelemetryCollectionManager
EXAMPLE 8
Get-XdrEndpointConfigurationCustomCollectionRule -Output YAML | Out-File "rules.yaml"
Exports all custom collection rules to a YAML file.
PARAMETERS
-Output
Specifies the output format. Valid values are 'PSObject' (default) and 'YAML'.
- PSObject: Returns PowerShell objects
- YAML: Returns rules formatted as YAML text for easy export and version control
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 1
Default value: PSObject
Accept pipeline input: False
Accept wildcard characters: False
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.