Skip to main content

New-XdrEndpointConfigurationCustomCollectionRule

SYNOPSIS​

Creates a new custom collection rule for Microsoft Defender for Endpoint from a YAML file.

SYNTAX​

New-XdrEndpointConfigurationCustomCollectionRule [-FilePath] <String[]> [[-Enabled] <Boolean>] [-BypassCache]
 [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION​

Creates custom collection rules for Microsoft Defender for Endpoint by importing YAML files. The YAML files should follow the schema format used by Get-XdrEndpointConfigurationCustomCollectionRule. Each file is validated before submission to ensure proper schema structure.

More information about the schema can be found here: https://github.com/FalconForceTeam/TelemetryCollectionManager

EXAMPLES​

EXAMPLE 1​

New-XdrEndpointConfigurationCustomCollectionRule -FilePath "C:\Rules\FileMonitoring.yaml"
Creates a single custom collection rule from the specified YAML file.

EXAMPLE 2​

New-XdrEndpointConfigurationCustomCollectionRule -FilePath "C:\Rules\*.yaml"
Creates custom collection rules from all YAML files in the specified directory.

EXAMPLE 3​

Get-ChildItem "C:\Rules" -Filter "*.yaml" |
    New-XdrEndpointConfigurationCustomCollectionRule
Creates custom collection rules from all YAML files using pipeline input.

PARAMETERS​

-FilePath​

Path to one or more YAML files containing custom collection rule definitions. Supports wildcards for batch processing.

Type: String[]
Parameter Sets: (All)
Aliases: FullName, Path

Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-Enabled​

Specifies whether the created rule(s) should be enabled. Default is $false.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 2
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-BypassCache​

Bypasses any existing cache entries when creating the rule. Will slow down processing if multiple rules are created in succession.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf​

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm​

Prompts for confirmation before creating each rule.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

Object​

Returns the created custom collection rule object(s) from the API.​

NOTES​

Required YAML properties:

  • name: Rule name (string)
  • enabled: Rule enabled status (boolean)
  • platform: Target platform (Windows, Linux, macOS)
  • scope: Rule scope (Organization)
  • table: Target table (DeviceFileEvents, DeviceNetworkEvents, etc.)
  • actionType: Event type to collect
  • filters: Filter expressions object

Optional YAML properties:

  • description: Rule description (string)