Skip to main content

Invoke-XdrXspmHuntingQuery

SYNOPSIS

Executes a hunting query against the Microsoft Defender XDR XSPM attack surface API.

SYNTAX

Invoke-XdrXspmHuntingQuery [-Query] <String> [[-Top] <Int32>] [[-Skip] <Int32>] [-ScenarioName] <String>
[-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION

Executes a custom hunting query against the XSPM (Extended Security Posture Management) attack surface API. Supports pagination through top and skip parameters. This function is designed to be used as a base for more specific attack surface queries.

EXAMPLES

EXAMPLE 1

Invoke-XdrXspmHuntingQuery -Query "AttackPathsV2 | take 10"
Executes a query to retrieve 10 attack paths.

EXAMPLE 2

Invoke-XdrXspmHuntingQuery -Query "AttackPathsV2" -Top 50 -Skip 100
Executes a query with pagination, skipping the first 100 records and returning up to 50.

EXAMPLE 3

Invoke-XdrXspmHuntingQuery -Query "AttackPathsV2 | where RiskLevel == 'High'" -Force
Executes a filtered query, bypassing the cache.

EXAMPLE 4

Invoke-XdrXspmHuntingQuery -Query "AttackPathsV2" -ScenarioName "CustomAnalysis"
Executes a query with a custom scenario name in the request header.

PARAMETERS

-Query

The hunting query string to execute. Should follow XSPM query syntax.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Top

The maximum number of records to return. Default is 100.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: 2
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-Skip

The number of records to skip for pagination. Default is 0.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: 3
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-ScenarioName

The scenario name to include in the request header (x-ms-scenario-name). This might be used for telemetry or logging purposes on the server side. Be careful out there.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 4
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Force

Bypasses the cache and forces a fresh retrieval from the API.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

Object

Returns the query results including totalRecords, count, skipToken, and data array.

NOTES