Invoke-XdrEndpointDeviceAutomatedInvestigation
SYNOPSIS
Starts an automated investigation on an endpoint device in Microsoft Defender XDR.
SYNTAX
Invoke-XdrEndpointDeviceAutomatedInvestigation [-DeviceId] <String> [-ProgressAction <ActionPreference>]
[-WhatIf] [-Confirm] [<CommonParameters>]
DESCRIPTION
Triggers an automated investigation (AutoIR) for the specified endpoint device. This initiates the Defender XDR automated investigation and remediation workflow.
EXAMPLES
EXAMPLE 1
Invoke-XdrEndpointDeviceAutomatedInvestigation -DeviceId "abc123"
Starts an automated investigation on the specified device.
PARAMETERS
-DeviceId
The device ID (SenseMachineId) of the target device.
Type: String
Parameter Sets: (All)
Aliases: MachineId, SenseMachineId
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-WhatIf
Shows what would happen if the command runs. The command is not run.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Confirm
Prompts for confirmation before making changes.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.