Skip to main content

Set-XdrEndpointConfigurationCustomCollectionRule

SYNOPSIS​

Updates an existing custom collection rule for Microsoft Defender for Endpoint.

SYNTAX​

PSObject (Default)​

Set-XdrEndpointConfigurationCustomCollectionRule -InputObject <Object> [-BypassCache]
 [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

YAML​

Set-XdrEndpointConfigurationCustomCollectionRule -FilePath <String[]> -RuleId <String> [-BypassCache]
 [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION​

Updates custom collection rules for Microsoft Defender for Endpoint by importing YAML files or PSObjects. The YAML files should follow the schema format used by Get-XdrEndpointConfigurationCustomCollectionRule. Each rule is validated before submission to ensure proper schema structure and that the rule exists.

More information about the schema can be found here: https://github.com/FalconForceTeam/TelemetryCollectionManager

EXAMPLES​

EXAMPLE 1​

Set-XdrEndpointConfigurationCustomCollectionRule -FilePath "C:\Rules\FileMonitoring.yaml" -RuleId "12345678-1234-1234-1234-123456789012"
Updates a single custom collection rule from the specified YAML file.

EXAMPLE 2​

Set-XdrEndpointConfigurationCustomCollectionRule -FilePath "C:\Rules\*.yaml" -RuleId "12345678-1234-1234-1234-123456789012"
Updates custom collection rules from all YAML files in the specified directory.

EXAMPLE 3​

Get-XdrEndpointConfigurationCustomCollectionRule |
    Where-Object  $_.ruleName -eq "My Rule"  |
    Set-XdrEndpointConfigurationCustomCollectionRule
Updates a rule by passing a PSObject from Get cmdlet through the pipeline.

EXAMPLE 4​

$rule = Get-XdrEndpointConfigurationCustomCollectionRule | Where-Object  $_.ruleName -eq "My Rule" 
$rule.isEnabled = $false
Set-XdrEndpointConfigurationCustomCollectionRule -InputObject $rule
Gets a rule, modifies it, and updates it.

PARAMETERS​

-FilePath​

Path to one or more YAML files containing custom collection rule definitions. Supports wildcards for batch processing. When using YAML files, the RuleId parameter must be provided.

Type: String[]
Parameter Sets: YAML
Aliases: FullName, Path

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-RuleId​

The GUID of the rule to update. Required when using FilePath parameter. This ensures you're updating the correct rule when using YAML files.

Type: String
Parameter Sets: YAML
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-InputObject​

PSObject containing the rule to update. The object must include a ruleId property. Typically obtained from Get-XdrEndpointConfigurationCustomCollectionRule.

Type: Object
Parameter Sets: PSObject
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False

-BypassCache​

Bypasses any existing cache entries when updating the rule. Will slow down processing if multiple rules are updated in succession.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf​

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm​

Prompts for confirmation before creating each rule.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

Object​

Returns the updated custom collection rule object(s) from the API.​

NOTES​

Required YAML properties:

  • name: Rule name (string)
  • enabled: Rule enabled status (boolean)
  • platform: Target platform (Windows, Linux, macOS)
  • scope: Rule scope (Organization)
  • table: Target table (DeviceFileEvents, DeviceNetworkEvents, etc.)
  • actionType: Event type to collect
  • filters: Filter expressions object

Optional YAML properties:

  • description: Rule description (string)

When using InputObject, the following API properties are required:

  • ruleId: The rule identifier (GUID)
  • ruleName, isEnabled, platform, scope, table, actionType, filters