Invoke-XdrXspmHuntingQuery
SYNOPSIS
Executes a hunting query against the Microsoft Defender XDR XSPM attack surface API.
SYNTAX
Invoke-XdrXspmHuntingQuery [-Query] <String> [[-Top] <Int32>] [[-Skip] <Int32>] [-ScenarioName] <String>
[-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Executes a custom hunting query against the XSPM (Extended Security Posture Management) attack surface API. Supports pagination through top and skip parameters. This function is designed to be used as a base for more specific attack surface queries.
EXAMPLES
EXAMPLE 1
Invoke-XdrXspmHuntingQuery -Query "AttackPathsV2 | take 10"
Executes a query to retrieve 10 attack paths.
EXAMPLE 2
Invoke-XdrXspmHuntingQuery -Query "AttackPathsV2" -Top 50 -Skip 100
Executes a query with pagination, skipping the first 100 records and returning up to 50.
EXAMPLE 3
Invoke-XdrXspmHuntingQuery -Query "AttackPathsV2 | where RiskLevel == 'High'" -Force
Executes a filtered query, bypassing the cache.
EXAMPLE 4
Invoke-XdrXspmHuntingQuery -Query "AttackPathsV2" -ScenarioName "CustomAnalysis"
Executes a query with a custom scenario name in the request header.
PARAMETERS
-Query
The hunting query string to execute. Should follow XSPM query syntax.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Top
The maximum number of records to return. Default is 100.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 2
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
-Skip
The number of records to skip for pagination. Default is 0.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 3
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
-ScenarioName
The scenario name to include in the request header (x-ms-scenario-name). This might be used for telemetry or logging purposes on the server side. Be careful out there.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 4
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.