Skip to main content

Get-XdrXspmAttackPath

SYNOPSIS

Retrieves attack path data from Microsoft Defender XDR XSPM.

SYNTAX

Get-XdrXspmAttackPath [[-Top] <Int32>] [[-Skip] <Int32>] [-All] [-Force] [-ProgressAction <ActionPreference>]
[<CommonParameters>]

DESCRIPTION

Gets attack path information from the XSPM (Extended Security Posture Management) attack surface API. Attack paths represent potential routes attackers could take to compromise critical assets. Supports pagination and can retrieve all available attack paths when using the -All parameter. This function includes caching support with a 30-minute TTL to reduce API calls.

EXAMPLES

EXAMPLE 1

Get-XdrXspmAttackPath
Retrieves the first 100 attack paths.

EXAMPLE 2

Get-XdrXspmAttackPath -Top 50
Retrieves the first 50 attack paths.

EXAMPLE 3

Get-XdrXspmAttackPath -Top 100 -Skip 100
Retrieves attack paths 101-200 (pagination).

EXAMPLE 4

Get-XdrXspmAttackPath -All
Retrieves all available attack paths by automatically handling pagination.

EXAMPLE 5

Get-XdrXspmAttackPath -All -Force
Retrieves all attack paths, bypassing the cache.

PARAMETERS

-Top

The maximum number of attack paths to return per page. Default is 100. Ignored when -All is specified.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-Skip

The number of attack paths to skip for pagination. Default is 0. Ignored when -All is specified.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: 2
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-All

When specified, retrieves all available attack paths by handling pagination automatically.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Force

Bypasses the cache and forces a fresh retrieval from the API.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

Array

Returns an array of attack path objects containing entry points, targets, paths, risk scores, and status information.

NOTES