Get-XdrEndpointDeviceActionResult
SYNOPSIS
Gets device action results and download URIs from Microsoft Defender XDR.
SYNTAX
List (Default)
Get-XdrEndpointDeviceActionResult -DeviceId <String> [-RequestGuid <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DownloadSupportLogsByDevice
Get-XdrEndpointDeviceActionResult -DeviceId <String> [-DownloadSupportLogs]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DownloadInvestigationPackageByDevice
Get-XdrEndpointDeviceActionResult -DeviceId <String> [-DownloadInvestigationPackage]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DownloadInvestigationPackageByRequest
Get-XdrEndpointDeviceActionResult [-DownloadInvestigationPackage] -RequestGuid <String>
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DownloadSupportLogsByRequest
Get-XdrEndpointDeviceActionResult [-DownloadSupportLogs] -RequestGuid <String>
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Retrieves the latest device action results for a device, or downloads completed investigation package or support log collection results.
When called with just -DeviceId, returns the latest action results for each action type including status, requestor, timestamps, and request GUIDs.
When called with -DownloadInvestigationPackage or -DownloadSupportLogs, retrieves the download URI for completed collection results. You can provide either a DeviceId (which auto-resolves the latest RequestGuid from machine state) or a RequestGuid directly.
EXAMPLES
EXAMPLE 1
Get-XdrEndpointDeviceActionResult -DeviceId "55a5db7b474470725e0131dec38c07b2f54bf2ad"
Gets the latest action results for the specified device.
EXAMPLE 2
Get-XdrEndpointDeviceActionResult -DeviceId "55a5db7b474470725e0131dec38c07b2f54bf2ad" -RequestGuid "1b2010b8-143e-441b-b5e9-c0b56c090a24"
Gets the action result for a specific request on the device.
EXAMPLE 3
Get-XdrEndpointDevice -DeviceId $deviceId | Get-XdrEndpointDeviceActionResult
Gets action results for a device using pipeline input.
EXAMPLE 4
Get-XdrEndpointDeviceActionResult -DownloadInvestigationPackage -DeviceId "55a5db7b474470725e0131dec38c07b2f54bf2ad"
Auto-resolves the latest investigation package request and returns its download URI.
EXAMPLE 5
Get-XdrEndpointDevice -DeviceId $deviceId | Get-XdrEndpointDeviceActionResult -DownloadSupportLogs
Gets the download URI for the latest support logs collection using pipeline input.
EXAMPLE 6
Get-XdrEndpointDeviceActionResult -DownloadInvestigationPackage -RequestGuid "b28b630c-d1a1-4b1d-9676-680c15366a52"
Downloads the investigation package for a specific request to the current working directory.
EXAMPLE 7
Get-XdrEndpointDeviceActionResult -DownloadSupportLogs -RequestGuid "abc12345-6789-0123-4567-890abcdef012"
Downloads the support logs for a specific request to the current working directory.
PARAMETERS
-DeviceId
The device identifier (SenseMachineId) to query action results for. Accepts pipeline input by property name and supports MachineId/SenseMachineId aliases.
Type: String
Parameter Sets: List, DownloadSupportLogsByDevice, DownloadInvestigationPackageByDevice
Aliases: MachineId, SenseMachineId
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-DownloadInvestigationPackage
Retrieve the download URI for the latest investigation package (forensics) collection.
Type: SwitchParameter
Parameter Sets: DownloadInvestigationPackageByDevice, DownloadInvestigationPackageByRequest
Aliases:
Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-DownloadSupportLogs
Retrieve the download URI for the latest support logs collection.
Type: SwitchParameter
Parameter Sets: DownloadSupportLogsByDevice, DownloadSupportLogsByRequest
Aliases:
Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-RequestGuid
The GUID of a specific request. When used with -DeviceId (List mode), filters the results to the matching request. When used with -DownloadInvestigationPackage or -DownloadSupportLogs, specifies the completed request to download results for.
Type: String
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
Type: String
Parameter Sets: DownloadInvestigationPackageByRequest, DownloadSupportLogsByRequest
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.