New-XdrConfigurationCriticalAssetManagementClassification

SYNOPSIS

Creates a new Critical Asset Management classification rule in Microsoft Defender XDR.

SYNTAX

Simple (Default)

New-XdrConfigurationCriticalAssetManagementClassification -RuleName <String> -RuleDescription <String>
 -AssetType <String> -CriticalityLevel <Object> -Property <String> -Operator <String> -Value <String[]>
 [-Disabled] [-PassThru] [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

Advanced

New-XdrConfigurationCriticalAssetManagementClassification -RuleName <String> -RuleDescription <String>
 -AssetType <String> -CriticalityLevel <Object> -RuleDefinition <Hashtable> [-Disabled] [-PassThru]
 [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION

Creates a custom Critical Asset Management classification rule to identify and classify critical assets in your organization. Rules can target Devices, Identities, or CloudResources and use property-based conditions to match assets.

Use Get-XdrConfigurationCriticalAssetManagementClassificationSchema to discover available properties and their types for building rule conditions.

EXAMPLES

EXAMPLE 1

New-XdrConfigurationCriticalAssetManagementClassification -RuleName "Executive Accounts" `
    -RuleDescription "Identifies executive user accounts" `
    -AssetType Identities `
    -CriticalityLevel VeryHigh `
    -Property "Job Title" `
    -Operator Equals `
    -Value "CEO", "CFO", "CTO"

Creates a Very High criticality rule for executive accounts using the friendly name.

EXAMPLE 2

New-XdrConfigurationCriticalAssetManagementClassification -RuleName "Domain Controllers" `
    -RuleDescription "Identifies domain controller servers" `
    -AssetType Devices `
    -CriticalityLevel 1 `
    -Property "Device Role" `
    -Operator Equals `
    -Value "DomainController"

Creates a High criticality rule for domain controllers using numeric level.

EXAMPLE 3

# Discover available properties for Devices, then create a rule
Get-XdrConfigurationCriticalAssetManagementClassificationSchema -AssetType Devices |
    Select-Object -ExpandProperty properties

New-XdrConfigurationCriticalAssetManagementClassification -RuleName "Windows Servers" ` -RuleDescription "Windows Server devices" ` -AssetType Devices ` -CriticalityLevel High ` -Property "OS Platform" ` -Operator Equals ` -Value "Windows" ` -PassThru

Discovers schema properties, then creates a rule and returns the full rule object.

EXAMPLE 4

$rule = @
    conditionType = "Operational"
    logicalOperator = "AND"
    conditions = @(
        @
            conditionType = "Simple"
            predicate = @
                property = "Device Type"
                operator = "Equals"
                value = @("Server")
            
        ,
        @
            conditionType = "Simple"
            predicate = @
                property = "Tags"
                operator = "Contains"
                value = @("Production")
            
        
    )

New-XdrConfigurationCriticalAssetManagementClassification -RuleName "Production Servers" `
    -RuleDescription "Production server devices" `
    -AssetType Devices `
    -CriticalityLevel High `
    -RuleDefinition $rule

Creates a rule with multiple conditions using AND logic.

EXAMPLE 5

# Full workflow: Create, verify, check affected assets, then clean up
$newRule = New-XdrConfigurationCriticalAssetManagementClassification `
    -RuleName "Test Rule" `
    -RuleDescription "Temporary test rule" `
    -AssetType Devices `
    -CriticalityLevel Low `
    -Property "Tags" `
    -Operator Contains `
    -Value "Test" `
    -PassThru

View the created rule with affected assets

Get-XdrConfigurationCriticalAssetManagementClassification -RuleId $newRule.ruleId -IncludeAffectedAssets

Clean up test rule

$newRule | Remove-XdrConfigurationCriticalAssetManagementClassification -Force

Demonstrates a complete workflow of creating, verifying, and removing a rule.

PARAMETERS

-RuleName

The display name for the new classification rule. Must be unique.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-RuleDescription

A description explaining what the rule identifies and its purpose.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-AssetType

The type of assets this rule applies to. Valid values are:

• Devices: Target device/endpoint assets
• Identities: Target user/identity assets
• CloudResources: Target cloud resource assets

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-CriticalityLevel

The criticality level to assign to matching assets. Accepts either numeric values or friendly names:

• 0 or 'VeryHigh': Very High criticality
• 1 or 'High': High criticality
• 2 or 'Medium': Medium criticality
• 3 or 'Low': Low criticality

Type: Object
Parameter Sets: (All)
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Property

The property name to filter on. Use Get-XdrConfigurationCriticalAssetManagementClassificationSchema to see available properties for each asset type.

Type: String
Parameter Sets: Simple
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Operator

The comparison operator. Valid values are:

• Equals: Exact match
• NotEquals: Does not match
• Contains: Contains the value (for string properties)
• NotContains: Does not contain the value

Type: String
Parameter Sets: Simple
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Value

The value(s) to match against. Can be a single value or an array of values.

Type: String[]
Parameter Sets: Simple
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-RuleDefinition

Advanced: A complete rule definition hashtable for complex rules with multiple conditions. When specified, Property, Operator, and Value parameters are ignored.

Example structure: @ conditionType = "Operational" logicalOperator = "AND" # or "OR" conditions = @( @ conditionType = "Simple" predicate = @ property = "Property Name" operator = "Equals" value = @("value1", "value2")

)

Type: Hashtable
Parameter Sets: Advanced
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Disabled

If specified, creates the rule in a disabled state.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-PassThru

When specified, returns the full rule object after creation. By default, only the ruleId is returned.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

PSCustomObject

Returns an object containing the ruleId of the newly created rule.

NOTES

• Rule names must be unique within the tenant
• Use Get-XdrConfigurationCriticalAssetManagementClassificationSchema to discover available properties
• Rules are always created in an enabled state (the -Disabled parameter is currently ignored by the API). To disable a rule after creation, use Set-XdrConfigurationCriticalAssetManagementClassification -Enabled $false
• Predefined rules cannot be created; this cmdlet only creates user-defined rules

RELATED LINKS