Connect-XdrByEstsCookie
SYNOPSIS
Establishes an authenticated session to the Microsoft Defender XDR portal.
SYNTAX
PlainText (Default)
Connect-XdrByEstsCookie -EstsAuthCookieValue <String> [-TenantId <String>] [-UserAgent <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
SecureString
Connect-XdrByEstsCookie -SecureEstsAuthCookieValue <SecureString> [-TenantId <String>] [-UserAgent <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Connects to security.microsoft.com using an ESTSAUTH cookie value to establish an authenticated web session. This function creates global session and headers variables that can be used by other XDR cmdlets to interact with the portal APIs.
You can provide the cookie value as either a plain string or as a secure string.
EXAMPLES
EXAMPLE 1
Connect-XdrByEstsCookie -EstsAuthCookieValue "your_cookie_value_here"
Connects to the XDR portal using the provided authentication cookie as plain text.
EXAMPLE 2
$secureCookie = ConvertTo-SecureString -String "your_cookie_value_here" -AsPlainText -Force
Connect-XdrByEstsCookie -SecureEstsAuthCookieValue $secureCookie
Connects to the XDR portal using the provided authentication cookie as a secure string.
EXAMPLE 3
Read-Host -AsSecureString "Enter ESTSAUTH cookie" | Connect-XdrByEstsCookie
Prompts for the cookie value securely via pipeline and connects to the XDR portal.
PARAMETERS
-EstsAuthCookieValue
The ESTSAUTH cookie value from an authenticated browser session as a plain string. Use this parameter set when you have the cookie as a plain text value.
Type: String
Parameter Sets: PlainText
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False
-SecureEstsAuthCookieValue
The ESTSAUTH cookie value from an authenticated browser session as a secure string. Use this parameter set when you want to pass the cookie value securely (e.g., from credential object).
Type: SecureString
Parameter Sets: SecureString
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False
-TenantId
The Tenant ID to use for the connection. If not provided, the default tenant will be used.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-UserAgent
The User-Agent string to use for the web requests. By default, uses the value returned by Get-XdrDefaultUserAgent.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: (Get-XdrDefaultUserAgent)
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.