Get-XdrIdentityUserTimeline
SYNOPSIS
Retrieves the timeline of events for a specific user from Microsoft Defender for Identity.
SYNTAX
ByUpnDateRange (Default)
Get-XdrIdentityUserTimeline -Upn <String> [-FromDate <DateTime>] [-ToDate <DateTime>] [-EventType <String[]>]
[-ListEventTypes] [-PageSize <Int32>] [-IncludeSentinelEvents] [-ThrottleLimit <Int32>]
[-TimeoutSeconds <Int32>] [-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>]
[-DisableAdaptiveChunking] [-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles]
[-ExportPath <String>] [-ProgressAction <ActionPreference>] [<CommonParameters>]
ByAadIdLastNDays
Get-XdrIdentityUserTimeline -AadId <String> -LastNDays <Int32> [-EventType <String[]>] [-ListEventTypes]
[-PageSize <Int32>] [-IncludeSentinelEvents] [-ThrottleLimit <Int32>] [-TimeoutSeconds <Int32>]
[-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>] [-DisableAdaptiveChunking]
[-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles] [-ExportPath <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
ByAadIdDateRange
Get-XdrIdentityUserTimeline -AadId <String> [-FromDate <DateTime>] [-ToDate <DateTime>] [-EventType <String[]>]
[-ListEventTypes] [-PageSize <Int32>] [-IncludeSentinelEvents] [-ThrottleLimit <Int32>]
[-TimeoutSeconds <Int32>] [-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>]
[-DisableAdaptiveChunking] [-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles]
[-ExportPath <String>] [-ProgressAction <ActionPreference>] [<CommonParameters>]
ByUpnLastNDays
Get-XdrIdentityUserTimeline -Upn <String> -LastNDays <Int32> [-EventType <String[]>] [-ListEventTypes]
[-PageSize <Int32>] [-IncludeSentinelEvents] [-ThrottleLimit <Int32>] [-TimeoutSeconds <Int32>]
[-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>] [-DisableAdaptiveChunking]
[-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles] [-ExportPath <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
BySidLastNDays
Get-XdrIdentityUserTimeline -Sid <String> -LastNDays <Int32> [-EventType <String[]>] [-ListEventTypes]
[-PageSize <Int32>] [-IncludeSentinelEvents] [-ThrottleLimit <Int32>] [-TimeoutSeconds <Int32>]
[-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>] [-DisableAdaptiveChunking]
[-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles] [-ExportPath <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
BySidDateRange
Get-XdrIdentityUserTimeline -Sid <String> [-FromDate <DateTime>] [-ToDate <DateTime>] [-EventType <String[]>]
[-ListEventTypes] [-PageSize <Int32>] [-IncludeSentinelEvents] [-ThrottleLimit <Int32>]
[-TimeoutSeconds <Int32>] [-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>]
[-DisableAdaptiveChunking] [-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles]
[-ExportPath <String>] [-ProgressAction <ActionPreference>] [<CommonParameters>]
ByRadiusUserIdLastNDays
Get-XdrIdentityUserTimeline -RadiusUserId <String> -LastNDays <Int32> [-EventType <String[]>] [-ListEventTypes]
[-PageSize <Int32>] [-IncludeSentinelEvents] [-ThrottleLimit <Int32>] [-TimeoutSeconds <Int32>]
[-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>] [-DisableAdaptiveChunking]
[-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles] [-ExportPath <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
ByRadiusUserIdDateRange
Get-XdrIdentityUserTimeline -RadiusUserId <String> [-FromDate <DateTime>] [-ToDate <DateTime>]
[-EventType <String[]>] [-ListEventTypes] [-PageSize <Int32>] [-IncludeSentinelEvents]
[-ThrottleLimit <Int32>] [-TimeoutSeconds <Int32>] [-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>]
[-ChunkSizeHours <Int32>] [-DisableAdaptiveChunking] [-RequestTimeoutSeconds <Int32>] [-OutputPath <String>]
[-KeepTempFiles] [-ExportPath <String>] [-ProgressAction <ActionPreference>] [<CommonParameters>]
ByInputObjectLastNDays
Get-XdrIdentityUserTimeline -InputObject <PSObject> -LastNDays <Int32> [-EventType <String[]>]
[-ListEventTypes] [-PageSize <Int32>] [-IncludeSentinelEvents] [-ThrottleLimit <Int32>]
[-TimeoutSeconds <Int32>] [-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>]
[-DisableAdaptiveChunking] [-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles]
[-ExportPath <String>] [-ProgressAction <ActionPreference>] [<CommonParameters>]
ByInputObjectDateRange
Get-XdrIdentityUserTimeline -InputObject <PSObject> [-FromDate <DateTime>] [-ToDate <DateTime>]
[-EventType <String[]>] [-ListEventTypes] [-PageSize <Int32>] [-IncludeSentinelEvents]
[-ThrottleLimit <Int32>] [-TimeoutSeconds <Int32>] [-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>]
[-ChunkSizeHours <Int32>] [-DisableAdaptiveChunking] [-RequestTimeoutSeconds <Int32>] [-OutputPath <String>]
[-KeepTempFiles] [-ExportPath <String>] [-ProgressAction <ActionPreference>] [<CommonParameters>]
ListEventTypesDateRange
Get-XdrIdentityUserTimeline [-FromDate <DateTime>] [-ToDate <DateTime>] [-EventType <String[]>]
[-ListEventTypes] [-PageSize <Int32>] [-IncludeSentinelEvents] [-ThrottleLimit <Int32>]
[-TimeoutSeconds <Int32>] [-MaxRetries <Int32>] [-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>]
[-DisableAdaptiveChunking] [-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles]
[-ExportPath <String>] [-ProgressAction <ActionPreference>] [<CommonParameters>]
ListEventTypesLastNDays
Get-XdrIdentityUserTimeline -LastNDays <Int32> [-EventType <String[]>] [-ListEventTypes] [-PageSize <Int32>]
[-IncludeSentinelEvents] [-ThrottleLimit <Int32>] [-TimeoutSeconds <Int32>] [-MaxRetries <Int32>]
[-RetryDelaySeconds <Int32>] [-ChunkSizeHours <Int32>] [-DisableAdaptiveChunking]
[-RequestTimeoutSeconds <Int32>] [-OutputPath <String>] [-KeepTempFiles] [-ExportPath <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets the timeline of security events for a user from Microsoft Defender for Identity with options to filter by date range, event types, and other parameters.
Uses parallel chunked requests (1-day intervals) to improve performance and support longer date ranges up to 180 days.
Supports two levels of parallelism:
- Parallel day chunks for a single user
- Parallel users when processing multiple users via pipeline
Final merged results are strictly filtered to the requested [FromDate, ToDate) range.
EXAMPLES
EXAMPLE 1
Get-XdrIdentityUserTimeline -Upn "user@domain.com"
Retrieves the last day of timeline events for the specified user.
EXAMPLE 2
Get-XdrIdentityUserTimeline -AadId "a2307c5a-76df-4513-b575-0537842c1d8b" -LastNDays 7
Retrieves 7 days of timeline events.
EXAMPLE 3
Get-XdrIdentityUser -Upn "user@domain.com" | Get-XdrIdentityUserTimeline -LastNDays 30
Retrieves user identity and pipes to timeline cmdlet for 30 days of events.
EXAMPLE 4
Get-XdrIdentityUserTimeline -Upn "user@domain.com" -LastNDays 7 -IncludeSentinelEvents
Retrieves timeline events including Sentinel UEBA anomalies.
EXAMPLE 5
Get-XdrIdentityUserTimeline -Upn "user@domain.com" -LastNDays 7 -ListEventTypes
Lists available event types for filtering for the specified user and time range.
EXAMPLE 6
Get-XdrIdentityUserTimeline -LastNDays 7 -ListEventTypes
Lists global event types for the selected time range.
EXAMPLE 7
Get-XdrIdentityUserTimeline -LastNDays 7 -ListEventTypes | Select-Object -ExpandProperty EventType
Returns only event type names for automation or downstream filtering.
EXAMPLE 8
Get-XdrIdentityUserTimeline -Upn "user@domain.com" -LastNDays 90 -ExportPath "C:\Reports\user_timeline.json"
Retrieves 90 days of timeline events and exports to JSON file.
PARAMETERS
-AadId
The Entra (Azure AD) object ID of the user.
Type: String
Parameter Sets: ByAadIdLastNDays, ByAadIdDateRange
Aliases: aad, ObjectId
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Upn
The User Principal Name of the user.
Type: String
Parameter Sets: ByUpnDateRange, ByUpnLastNDays
Aliases: UserPrincipalName, Email
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Sid
The Security Identifier (SID) of the user.
Type: String
Parameter Sets: BySidLastNDays, BySidDateRange
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-RadiusUserId
The RADIUS user ID in format "User_tenantId_userId".
Type: String
Parameter Sets: ByRadiusUserIdLastNDays, ByRadiusUserIdDateRange
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-InputObject
A user object from Get-XdrIdentityUser containing resolved identifiers. Accepts pipeline input.
Type: PSObject
Parameter Sets: ByInputObjectLastNDays, ByInputObjectDateRange
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False
-FromDate
The start date for the timeline. Defaults to 1 day before current time.
Type: DateTime
Parameter Sets: ByUpnDateRange, ByAadIdDateRange, BySidDateRange, ByRadiusUserIdDateRange, ByInputObjectDateRange, ListEventTypesDateRange
Aliases:
Required: False
Position: Named
Default value: ((Get-Date).AddDays(-1))
Accept pipeline input: False
Accept wildcard characters: False
-ToDate
The end date for the timeline. Defaults to current time.
Type: DateTime
Parameter Sets: ByUpnDateRange, ByAadIdDateRange, BySidDateRange, ByRadiusUserIdDateRange, ByInputObjectDateRange, ListEventTypesDateRange
Aliases:
Required: False
Position: Named
Default value: (Get-Date)
Accept pipeline input: False
Accept wildcard characters: False
-LastNDays
Specifies the number of days to look back from current time. Cannot be used with FromDate or ToDate parameters. Maximum is 180 days.
Type: Int32
Parameter Sets: ByAadIdLastNDays, ByUpnLastNDays, BySidLastNDays, ByRadiusUserIdLastNDays, ByInputObjectLastNDays, ListEventTypesLastNDays
Aliases:
Required: True
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
-EventType
Filter events by type. Available types are retrieved dynamically from the FilterOptions API. Use -ListEventTypes to see available options.
Type: String[]
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ListEventTypes
Lists available event types for filtering for the specified user and time range. Returns pipeline objects with EventType, Scope, and User properties. If no user identifier is supplied, returns global event types for the selected time range.
Type: SwitchParameter
Parameter Sets: ByUpnDateRange, ByAadIdLastNDays, ByAadIdDateRange, ByUpnLastNDays, BySidLastNDays, BySidDateRange, ByRadiusUserIdLastNDays, ByRadiusUserIdDateRange, ByInputObjectLastNDays, ByInputObjectDateRange
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
Type: SwitchParameter
Parameter Sets: ListEventTypesDateRange, ListEventTypesLastNDays
Aliases:
Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-PageSize
The number of events to return per page. Defaults to 1000.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 1000
Accept pipeline input: False
Accept wildcard characters: False
-IncludeSentinelEvents
Include Microsoft Sentinel UEBA anomaly events in the timeline results. Requires the user to have an armId (Sentinel entity ID) which is auto-detected from the resolved user identifiers.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ThrottleLimit
The maximum number of concurrent requests. Defaults to 32.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 32
Accept pipeline input: False
Accept wildcard characters: False
-TimeoutSeconds
Maximum time in seconds to wait for all requests to complete. Defaults to 3600 (1 hour).
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 3600
Accept pipeline input: False
Accept wildcard characters: False
-MaxRetries
Maximum number of retry attempts for failed API requests. Defaults to 3.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 3
Accept pipeline input: False
Accept wildcard characters: False
-RetryDelaySeconds
Base delay in seconds between retry attempts (uses exponential backoff). Defaults to 5.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 5
Accept pipeline input: False
Accept wildcard characters: False
-ChunkSizeHours
Maximum size of each time chunk in hours (1-168). Defaults to 72 hours. By default, adaptive chunking may reduce this value based on the requested range to improve throughput and avoid oversized identity timeline windows.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 72
Accept pipeline input: False
Accept wildcard characters: False
-DisableAdaptiveChunking
Disables adaptive chunk sizing and forces fixed-size chunks based on ChunkSizeHours.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-RequestTimeoutSeconds
Timeout in seconds for individual HTTP requests (10-120). Defaults to 30. If a single API call takes longer than this, it will timeout and retry.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 30
Accept pipeline input: False
Accept wildcard characters: False
-OutputPath
Optional. The path to store temporary JSON files. Defaults to a temp folder.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-KeepTempFiles
If specified, keeps the temporary JSON files after merging.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ExportPath
Optional. Export results directly to a JSON file at the specified path.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
INPUTS
OUTPUTS
XdrIdentityUserTimelineEvent[]
Returned when -ListEventTypes is not specified.
PSCustomObject
Returned when -ListEventTypes is specified, with EventType, Scope, and User properties.
NOTES
The identity timeline API uses Unix timestamps in seconds (not milliseconds).