Get-XdrAdvancedHuntingUserHistory
SYNOPSIS
Retrieves Advanced Hunting user history from Microsoft Defender XDR.
SYNTAX
Days (Default)
Get-XdrAdvancedHuntingUserHistory [-Days <Int32>] [-MaxResults <Int32>] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
StartTime
Get-XdrAdvancedHuntingUserHistory [-StartTime <DateTime>] [-MaxResults <Int32>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets the user's Advanced Hunting query history from the Microsoft Defender XDR portal. By default, retrieves the last 28 days of history with a maximum of 30 results.
EXAMPLES
EXAMPLE 1
Get-XdrAdvancedHuntingUserHistory
Retrieves the last 28 days of Advanced Hunting user history with up to 30 results.
EXAMPLE 2
Get-XdrAdvancedHuntingUserHistory -Days 7 -MaxResults 50
Retrieves the last 7 days of user history with up to 50 results.
EXAMPLE 3
Get-XdrAdvancedHuntingUserHistory -StartTime "2025-10-18T18:36:11.482Z"
Retrieves user history from the specified start time with up to 30 results.
PARAMETERS
-StartTime
The start time for retrieving user history. Cannot be used together with Days parameter.
Type: DateTime
Parameter Sets: StartTime
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Days
The number of days to look back from the current date. Cannot be used together with StartTime parameter. Defaults to 28 days if neither StartTime nor Days is specified.
Type: Int32
Parameter Sets: Days
Aliases:
Required: False
Position: Named
Default value: 28
Accept pipeline input: False
Accept wildcard characters: False
-MaxResults
The maximum number of results to return. Defaults to 30.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 30
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.