Get-XdrEndpointDevice
SYNOPSIS
Retrieves endpoint devices from Microsoft Defender XDR.
SYNTAX
List (Default)
Get-XdrEndpointDevice [-MachineSearchPrefix <String>] [-LookingBackInDays <Int32>] [-PageIndex <Int32>]
[-PageSize <Int32>] [-SortByField <String>] [-SortOrder <String>] [-HideLowFidelityDevices <Boolean>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DeviceId
Get-XdrEndpointDevice -DeviceId <String> [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets endpoint devices from the Microsoft Defender XDR portal. Supports two modes:
- List (default): Retrieves devices with options to filter, sort, and paginate results.
- DeviceId: Retrieves detailed information for a single device by its identifier. Uses the getMachine API and caches results for 5 minutes.
EXAMPLES
EXAMPLE 1
Get-XdrEndpointDevice
Retrieves the first 25 devices sorted by risk score in descending order using default settings.
EXAMPLE 2
Get-XdrEndpointDevice -PageSize 100 -PageIndex 2
Retrieves the second page of 100 devices.
EXAMPLE 3
Get-XdrEndpointDevice -SortByField "lastSeen" -SortOrder "Ascending"
Retrieves devices sorted by last seen date in ascending order.
EXAMPLE 4
Get-XdrEndpointDevice -HideLowFidelityDevices $false -LookingBackInDays 90
Retrieves devices including low fidelity devices with a 90-day lookback period.
EXAMPLE 5
Get-XdrEndpointDevice -MachineSearchPrefix "DESKTOP"
Retrieves devices whose names start with "DESKTOP".
EXAMPLE 6
Get-XdrEndpointDevice -DeviceId "abc123def456"
Retrieves detailed information for a single device by its identifier.
PARAMETERS
-DeviceId
The device identifier (also known as MachineId or SenseMachineId). When specified, retrieves detailed information for a single device. Results are cached for 5 minutes.
Type: String
Parameter Sets: DeviceId
Aliases: MachineId, SenseMachineId
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Force
Bypasses the cache when using -DeviceId and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: DeviceId
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-MachineSearchPrefix
Optional. Search for devices by name prefix. Use this to filter devices whose names start with the specified string.
Type: String
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-LookingBackInDays
The number of days to look back for device data. Defaults to 30 days.
Type: Int32
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: 30
Accept pipeline input: False
Accept wildcard characters: False
-PageIndex
The page index for pagination. Defaults to 1.
Type: Int32
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: 1
Accept pipeline input: False
Accept wildcard characters: False
-PageSize
The number of devices to return per page. Defaults to 25.
Type: Int32
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: 25
Accept pipeline input: False
Accept wildcard characters: False
-SortByField
The field to sort devices by. Defaults to 'riskscore'.
Type: String
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: Riskscore
Accept pipeline input: False
Accept wildcard characters: False
-SortOrder
The sort order for results. Valid values are 'Ascending' or 'Descending'. Defaults to 'Descending'.
Type: String
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: Descending
Accept pipeline input: False
Accept wildcard characters: False
-HideLowFidelityDevices
Whether to hide low fidelity devices from the results. Defaults to $true.
Type: Boolean
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: True
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.