Skip to main content

Get-XdrEndpointConfigurationCustomCollectionRule

SYNOPSIS

Retrieves custom collection rules for Microsoft Defender for Endpoint.

SYNTAX

Get-XdrEndpointConfigurationCustomCollectionRule [[-Output] <String>] [-Force]
[-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION

Gets the custom collection rules configured for Microsoft Defender for Endpoint. Custom collection rules allow you to collect specific file, registry, process, and network events based on defined criteria to support advanced hunting and detection scenarios. This function includes caching support with a 30-minute TTL to reduce API calls.

It incorporates the same YAML schema as used by Telemetry Collection Manager https://github.com/FalconForceTeam/TelemetryCollectionManager for easy export and version control of custom collection rules.

EXAMPLES

EXAMPLE 1

Get-XdrEndpointConfigurationCustomCollectionRule
Retrieves all custom collection rules using cached data if available.

EXAMPLE 2

Get-XdrEndpointConfigurationCustomCollectionRule -Force
Forces a fresh retrieval of custom collection rules, bypassing the cache.

EXAMPLE 3

Get-XdrEndpointConfigurationCustomCollectionRule | Where-Object  $_.isEnabled -eq $true 
Retrieves only enabled custom collection rules.

EXAMPLE 4

Get-XdrEndpointConfigurationCustomCollectionRule |
Where-Object $_.table -eq "DeviceFileEvents" |
Format-Table ruleName, actionType, platform, isEnabled -AutoSize
Retrieves custom collection rules for file events and displays them in a table.

EXAMPLE 5

$rules = Get-XdrEndpointConfigurationCustomCollectionRule
$rules | Where-Object $_.createdBy -eq "admin@contoso.com"
Retrieves all rules created by a specific user.

EXAMPLE 6

Get-XdrEndpointConfigurationCustomCollectionRule |
Select-Object ruleName, table, actionType, scope, isEnabled
Retrieves custom collection rules and displays key properties.

EXAMPLE 7

Get-XdrEndpointConfigurationCustomCollectionRule -Output YAML
Retrieves custom collection rules in YAML format for export.
YAML format is intended to use with https://github.com/FalconForceTeam/TelemetryCollectionManager

EXAMPLE 8

Get-XdrEndpointConfigurationCustomCollectionRule -Output YAML | Out-File "rules.yaml"
Exports all custom collection rules to a YAML file.

PARAMETERS

-Output

Specifies the output format. Valid values are 'PSObject' (default) and 'YAML'.

  • PSObject: Returns PowerShell objects
  • YAML: Returns rules formatted as YAML text for easy export and version control
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: PSObject
Accept pipeline input: False
Accept wildcard characters: False

-Force

Bypasses the cache and forces a fresh retrieval from the API.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

Object[] or String

When Output is 'PSObject' (default): Returns an array of custom collection rule objects.

When Output is 'YAML': Returns a string containing YAML-formatted rules.

When Output is 'PSObject' (default): Returns an array of custom collection rule objects containing:

- ruleId: Unique identifier for the rule (GUID)

- ruleName: Name of the collection rule

- ruleDescription: Description of the rule

- scope: Rule scope (e.g., "Organization")

- isEnabled: Boolean indicating if the rule is active

- table: Target table (e.g., DeviceFileEvents, DeviceNetworkEvents)

- actionType: Event type to collect (e.g., FileDeleted, ConnectionSuccess)

- createdBy: User who created the rule

- creationDateTimeUtc: Creation timestamp

- lastModifiedBy: User who last modified the rule

- lastModificationDateTimeUtc: Last modification timestamp

- platform: Target platform (e.g., Windows, Linux, macOS)

- filters: Filter criteria for the collection rule

- version: Rule version number

- updateKey: Optimistic concurrency control key

NOTES