Merge-XdrIncident

SYNOPSIS

Merges multiple incidents into a single incident in Microsoft Defender XDR.

SYNTAX

Merge-XdrIncident [-IncidentIds] <Int32[]> [-Comment] <String> [-ProgressAction <ActionPreference>] [-WhatIf]
 [-Confirm] [<CommonParameters>]

DESCRIPTION

Combines multiple incidents into one incident in Microsoft Defender XDR. All incidents must exist before merging. The cmdlet validates each incident ID before proceeding. This operation requires confirmation due to its high impact.

EXAMPLES

EXAMPLE 1

Merge-XdrIncident -IncidentIds 2821, 2823 -Comment "Related phishing attacks"
Merges incidents 2821 and 2823 with a comment.

EXAMPLE 2

Merge-XdrIncident -IncidentIds 100, 101, 102 -Comment "Same threat actor campaign"
Merges three incidents into one.

EXAMPLE 3

$incidents = 2821, 2823, 2825
Merge-XdrIncident -IncidentIds $incidents -Comment "Coordinated attack"
Merges multiple incidents using a variable.

PARAMETERS

-IncidentIds

Array of incident IDs to merge. Must contain at least 2 incident IDs. All incidents will be validated before the merge operation.

Type: Int32[]
Parameter Sets: (All)
Aliases:

Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Comment

Comment explaining the reason for merging the incidents. This will be recorded in the incident history.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf

Shows what would happen if the cmdlet runs. The JSON body for the merge operation will be displayed.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

Prompts for confirmation before executing the merge operation.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

Object

Returns the result of the merge operation from the API.

NOTES

This operation cannot be undone. Use with caution. All specified incidents must exist in the tenant. The operation requires user confirmation unless -Confirm:$false is specified.

RELATED LINKS