Skip to main content

Get-XdrIncident

SYNOPSIS

Retrieves incidents from Microsoft Defender XDR.

SYNTAX

List (Default)

Get-XdrIncident [-TitleSearchTerms <String[]>] [-LookBackInDays <Int32>] [-SortByField <String>]
[-SortOrder <String>] [-PageSize <Int32>] [-PageIndex <Int32>] [-DefenderExpertsLicensed] [-All] [-Force]
[-ProgressAction <ActionPreference>] [<CommonParameters>]

ById

Get-XdrIncident -IncidentId <Int32> [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION

Gets incidents from Microsoft Defender XDR with support for pagination, sorting, and filtering. This cmdlet translates severity values and detection source IDs to friendly names. Severity translations: 32=Information, 64=Low, 128=Medium, 256=High This function includes caching support with a 10-minute TTL to reduce API calls.

EXAMPLES

EXAMPLE 1

Get-XdrIncident
Retrieves the first 40 incidents from the last 30 days, sorted by TopRisk in descending order.

EXAMPLE 2

Get-XdrIncident -LookBackInDays 7 -PageSize 100
Retrieves the first 100 incidents from the last 7 days.

EXAMPLE 3

Get-XdrIncident -SortByField CreatedDate -SortOrder Ascending
Retrieves incidents sorted by creation date in ascending order (oldest first).

EXAMPLE 4

Get-XdrIncident -TitleSearchTerms "ransomware", "phishing"
Retrieves incidents with titles containing "ransomware" or "phishing".

EXAMPLE 5

Get-XdrIncident -All
Retrieves all incidents by automatically paging through all results.

EXAMPLE 6

Get-XdrIncident -DefenderExpertsLicensed -LookBackInDays 90
Retrieves incidents from the last 90 days for a tenant with Defender Experts license.

EXAMPLE 7

Get-XdrIncident -IncidentId 2823
Retrieves a specific incident by its ID.

EXAMPLE 8

Get-XdrIncident | Where-Object  $_.SeverityName -eq "High" 
Retrieves incidents and filters for high severity ones.

PARAMETERS

-TitleSearchTerms

Array of search terms to filter incidents by title.

Type: String[]
Parameter Sets: List
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-LookBackInDays

Number of days to look back for incidents. Default is 30.

Type: Int32
Parameter Sets: List
Aliases:

Required: False
Position: Named
Default value: 30
Accept pipeline input: False
Accept wildcard characters: False

-SortByField

Field to sort by. Valid values are: TopRisk, CreatedDate, LastUpdatedDate, Status, severity, name. Default is TopRisk.

Type: String
Parameter Sets: List
Aliases:

Required: False
Position: Named
Default value: TopRisk
Accept pipeline input: False
Accept wildcard characters: False

-SortOrder

Sort order. Valid values are Ascending or Descending. Default is Descending.

Type: String
Parameter Sets: List
Aliases:

Required: False
Position: Named
Default value: Descending
Accept pipeline input: False
Accept wildcard characters: False

-PageSize

Number of incidents to retrieve per page. Default is 40.

Type: Int32
Parameter Sets: List
Aliases:

Required: False
Position: Named
Default value: 40
Accept pipeline input: False
Accept wildcard characters: False

-PageIndex

Page index for pagination. Default is 1.

Type: Int32
Parameter Sets: List
Aliases:

Required: False
Position: Named
Default value: 1
Accept pipeline input: False
Accept wildcard characters: False

-DefenderExpertsLicensed

Indicates if Microsoft Defender Experts for XDR license is assigned to the tenant. Default is false.

Type: SwitchParameter
Parameter Sets: List
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-All

Retrieves all incidents by automatically paging through all results. When specified, PageSize and PageIndex parameters are used for the page size, but pagination is automatic.

Type: SwitchParameter
Parameter Sets: List
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Force

Bypasses the cache and forces a fresh retrieval from the API.

Type: SwitchParameter
Parameter Sets: List
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-IncidentId

Retrieves a specific incident by its ID. When specified, all other filtering and pagination parameters are ignored. Cannot be combined with any other parameters.

Type: Int32
Parameter Sets: ById
Aliases:

Required: True
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

Object[]

Returns an array of incident objects with properties including:

- IncidentId: Unique incident identifier

- Title: Incident title

- Severity: Numeric severity value

- SeverityName: Friendly severity name (Information/Low/Medium/High)

- DetectionSources: Array of numeric detection source IDs

- DetectionSourceNames: Array of friendly detection source names

- Status: Incident status

- CreatedTime: When the incident was created

- LastUpdateTime: When the incident was last updated

- AlertCount: Number of alerts in the incident

- Classification: Incident classification

- Determination: Incident determination

And many other properties from the API response

NOTES