Skip to main content

Invoke-XdrMtoAdvancedHunting

SYNOPSIS​

Executes an Advanced Hunting query across multiple tenants in MTO (Multi-Tenant Organization).

SYNTAX​

DaysAgo (Default)​

Invoke-XdrMtoAdvancedHunting -QueryText <String> [-TenantIds <String[]>] [-DaysAgo <Int32>]
 [-EndTime <DateTime>] [-MaxRecordCount <Int32>] [-SelectedWorkspaces <Hashtable>]
 [-ProgressAction <ActionPreference>] [<CommonParameters>]

MinutesAgo​

Invoke-XdrMtoAdvancedHunting -QueryText <String> [-TenantIds <String[]>] [-MinutesAgo <Int32>]
 [-EndTime <DateTime>] [-MaxRecordCount <Int32>] [-SelectedWorkspaces <Hashtable>]
 [-ProgressAction <ActionPreference>] [<CommonParameters>]

CustomTime​

Invoke-XdrMtoAdvancedHunting -QueryText <String> [-TenantIds <String[]>] [-StartTime <DateTime>]
 [-EndTime <DateTime>] [-MaxRecordCount <Int32>] [-SelectedWorkspaces <Hashtable>]
 [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Runs a KQL (Kusto Query Language) Advanced Hunting query across one or more tenants in the Microsoft Defender XDR multi-tenant view. Supports querying across tenants with configurable time ranges and optional workspace selection.

EXAMPLES​

EXAMPLE 1​

Invoke-XdrMtoAdvancedHunting -QueryText "DeviceEvents | limit 10"
Executes a simple query across the current tenant for the last 7 days.

EXAMPLE 2​

Invoke-XdrMtoAdvancedHunting -QueryText "DeviceEvents | limit 10" -DaysAgo 30
Executes a query across the current tenant for the last 30 days.

EXAMPLE 3​

Invoke-XdrMtoAdvancedHunting -QueryText "DeviceEvents | limit 10" -MinutesAgo 60
Executes a query for the last 60 minutes.

EXAMPLE 4​

$tenants = @("e3686c4f-af27-4f22-b9de-062f05b93aac", "48315f62-774c-49c9-884b-34a8931b2b1f")
Invoke-XdrMtoAdvancedHunting -QueryText "DeviceInfo | take 5" -TenantIds $tenants
Executes a query across multiple specified tenants.

EXAMPLE 5​

$query = @"
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName =~ "powershell.exe"
| take 100
"@
Invoke-XdrMtoAdvancedHunting -QueryText $query -DaysAgo 1 -Verbose
Executes a multi-line query with verbose output showing per-tenant latency.

EXAMPLE 6​

$workspaces = @
    "e3686c4f-af27-4f22-b9de-062f05b93aac" = @("008e3d12-e648-46e1-83ec-f631d94bf434")

Invoke-XdrMtoAdvancedHunting -QueryText "DeviceEvents | limit 10" -SelectedWorkspaces $workspaces
Executes a query with specific workspace selection.

PARAMETERS​

-QueryText​

The KQL query to execute. This is a required parameter.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-TenantIds​

Array of tenant IDs (GUIDs) to query. If not provided, uses the tenant ID from the cache (the currently selected tenant in MTO view).

Type: String[]
Parameter Sets: (All)
Aliases: TenantId

Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-DaysAgo​

Number of days to look back from now for the query time range. Default is 7 days. Cannot be used with -StartTime or -MinutesAgo parameters.

Type: Int32
Parameter Sets: DaysAgo
Aliases:

Required: False
Position: Named
Default value: 7
Accept pipeline input: False
Accept wildcard characters: False

-MinutesAgo​

Number of minutes to look back from now for the query time range. Cannot be used with -StartTime or -DaysAgo parameters.

Type: Int32
Parameter Sets: MinutesAgo
Aliases:

Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-StartTime​

Custom start time for the query (DateTime object or string in ISO 8601 format). Cannot be used with -DaysAgo or -MinutesAgo parameters.

Type: DateTime
Parameter Sets: CustomTime
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-EndTime​

End time for the query (DateTime object or string in ISO 8601 format). Default is the current time.

Type: DateTime
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: (Get-Date)
Accept pipeline input: False
Accept wildcard characters: False

-MaxRecordCount​

Maximum number of records to return. If not specified, the API default is used.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-SelectedWorkspaces​

Hashtable mapping tenant IDs to arrays of workspace IDs for querying specific workspaces. Example: @ "tenantId1" = @("workspaceId1", "workspaceId2"); "tenantId2" = @("workspaceId3")

Type: Hashtable
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

PSCustomObject​

Returns a custom object containing:​

- Schema: Array of column definitions with Name, Type, and Entity properties​

- Results: Array of result objects containing the query results​

- Quota: Array of quota information per tenant​

- ChartVisualization: Array of chart type information per tenant​

NOTES​

This cmdlet requires an active MTO session established via Connect-Xdr. Warnings are generated for any tenant that returns an error. Verbose output includes per-tenant latency information.