Get-XdrActionsCenterHistory
SYNOPSIS
Retrieves historical actions from the Microsoft Defender XDR Action Center.
SYNTAX
Months (Default)
Get-XdrActionsCenterHistory [-SortByField <String>] [-SortOrder <String>] [-PageIndex <Int32>]
[-PageSize <Int32>] [-ToDate <DateTime>] [-Months <Int32>] [-UseMtpApi <Boolean>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
FromDate
Get-XdrActionsCenterHistory [-SortByField <String>] [-SortOrder <String>] [-PageIndex <Int32>]
[-PageSize <Int32>] [-ToDate <DateTime>] [-FromDate <DateTime>] [-UseMtpApi <Boolean>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets a list of historical actions from the Microsoft Defender XDR Action Center with options to filter by date range, sort, and paginate the results.
EXAMPLES
EXAMPLE 1
Get-XdrActionsCenterHistory
Retrieves the last 6 months of action center history with default settings.
EXAMPLE 2
Get-XdrActionsCenterHistory -PageSize 50 -PageIndex 2
Retrieves the second page of 50 historical actions.
EXAMPLE 3
Get-XdrActionsCenterHistory -Months 3
Retrieves the last 3 months of action center history.
EXAMPLE 4
Get-XdrActionsCenterHistory -FromDate (Get-Date).AddDays(-30) -ToDate (Get-Date)
Retrieves the last 30 days of action center history.
EXAMPLE 5
Get-XdrActionsCenterHistory -SortByField "ActionUpdateTime" -SortOrder "Ascending"
Retrieves actions sorted by action update time in ascending order.
PARAMETERS
-SortByField
The field to sort actions by. Valid values are: InvestigationId, ApprovalId, ActionType, EntityType, Asset, Decision, DecidedBy, ActionSource, Status, ActionUpdateTime. Defaults to 'ActionUpdateTime'.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: ActionUpdateTime
Accept pipeline input: False
Accept wildcard characters: False
-SortOrder
The sort order for results. Valid values are 'Ascending' or 'Descending'. Defaults to 'Descending'.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: Descending
Accept pipeline input: False
Accept wildcard characters: False
-PageIndex
The page index for pagination. Defaults to 1.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 1
Accept pipeline input: False
Accept wildcard characters: False
-PageSize
The number of actions to return per page. Defaults to 100.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 100
Accept pipeline input: False
Accept wildcard characters: False
-ToDate
The end date for the history query. Defaults to current time.
Type: DateTime
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: (Get-Date)
Accept pipeline input: False
Accept wildcard characters: False
-FromDate
The start date for the history query. Defaults to 6 months before ToDate.
Type: DateTime
Parameter Sets: FromDate
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Months
The number of months to look back from the current date. Cannot be used together with FromDate parameter. Defaults to 6 months if neither FromDate nor Months is specified.
Type: Int32
Parameter Sets: Months
Aliases:
Required: False
Position: Named
Default value: 6
Accept pipeline input: False
Accept wildcard characters: False
-UseMtpApi
Whether to use the MTP API. Defaults to $true.
Type: Boolean
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: True
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.