Remove-XdrAdvancedHuntingFunction

SYNOPSIS

Removes an Advanced Hunting function from Microsoft Defender XDR.

SYNTAX

Id (Default)

Remove-XdrAdvancedHuntingFunction [-Id] <Int32> [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm]
 [<CommonParameters>]

InputObject

Remove-XdrAdvancedHuntingFunction -InputObject <Object> [-ProgressAction <ActionPreference>] [-WhatIf]
 [-Confirm] [<CommonParameters>]

DESCRIPTION

Deletes a saved function for Advanced Hunting queries in Microsoft Defender XDR. The function must exist before it can be removed. The cmdlet will verify the function exists before attempting deletion.

EXAMPLES

EXAMPLE 1

Remove-XdrAdvancedHuntingFunction -Id 6
Removes the function with ID 6.

EXAMPLE 2

Get-XdrAdvancedHuntingFunction -Id 6 | Remove-XdrAdvancedHuntingFunction
Gets a function and removes it through the pipeline.

EXAMPLE 3

Get-XdrAdvancedHuntingFunction | Where-Object  $_.Name -eq "OldFunction"  | Remove-XdrAdvancedHuntingFunction
Finds a function by name and removes it.

PARAMETERS

-Id

The ID of the function to remove. This is mandatory to ensure the correct function is deleted.

Type: Int32
Parameter Sets: Id
Aliases:

Required: True
Position: 1
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-InputObject

PSObject containing the function to remove. The object must include an Id property. Typically obtained from Get-XdrAdvancedHuntingFunction.

Type: Object
Parameter Sets: InputObject
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False

-WhatIf

Shows what would happen if the cmdlet runs. The function is not created.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

None

This cmdlet does not return any output upon successful deletion.

NOTES

The function must exist before it can be removed. This operation requires confirmation by default due to high impact.

RELATED LINKS