Skip to main content

Invoke-XdrHuntingQueryValidation

SYNOPSIS

Validates an Advanced Hunting query for custom detection rules in Microsoft Defender XDR.

SYNTAX

Invoke-XdrHuntingQueryValidation [-QueryText] <String> [[-HuntingRule] <Object>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION

Validates whether an Advanced Hunting query is allowed and checks the permissions required for creating custom detection rules. This is useful before attempting to create a custom detection rule to ensure the query syntax is valid and the user has appropriate permissions.

EXAMPLES

EXAMPLE 1

ago(1h)"
Validates the specified Advanced Hunting query.

EXAMPLE 2

$query = @"
DeviceEvents
| where ActionType == "ProcessCreated"
| where FileName == "powershell.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
"@
Invoke-XdrHuntingQueryValidation -QueryText $query
Validates a multi-line Advanced Hunting query.

EXAMPLE 3

Invoke-XdrHuntingQueryValidation -QueryText "DeviceProcessEvents | where false"
Validates a simple test query that returns no results.

PARAMETERS

-QueryText

The KQL (Kusto Query Language) query text to validate. This should be a valid Advanced Hunting query.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-HuntingRule

Optional hunting rule object to validate. If not specified, defaults to null.

Type: Object
Parameter Sets: (All)
Aliases:

Required: False
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

Object

Returns a validation response object containing:

- IsAllowed: Boolean indicating if the query is allowed

- Permissions: Object containing permission details for each workload (Mdatp, etc.)

NOTES