Get-XdrSuppressionRule
SYNOPSIS
Retrieves alert suppression rules from Microsoft Defender XDR.
SYNTAX
Get-XdrSuppressionRule [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets the list of alert suppression rules configured in the Microsoft Defender XDR portal, including rule details such as title, conditions, scope, status, and matching alert counts. This function includes caching support with a 30-minute TTL to reduce API calls.
EXAMPLES
EXAMPLE 1
Get-XdrSuppressionRule
Retrieves all suppression rules using cached data if available.
EXAMPLE 2
Get-XdrSuppressionRule -Force
Forces a fresh retrieval of suppression rules, bypassing the cache.
EXAMPLE 3
Get-XdrSuppressionRule | Where-Object $_.IsEnabled
Retrieves only enabled suppression rules.
EXAMPLE 4
Get-XdrSuppressionRule | Where-Object $_.CreatedBy -eq 'Microsoft'
Retrieves only Microsoft-created suppression rules.
EXAMPLE 5
Get-XdrSuppressionRule | Where-Object $_.MatchingAlertsCount -gt 0
Retrieves suppression rules that have matched alerts.
PARAMETERS
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.