Get-XdrEndpointDeviceLiveResponseLibraryFile
SYNOPSIS
Downloads a script file from the Live Response library.
SYNTAX
Get-XdrEndpointDeviceLiveResponseLibraryFile [-FileName] <String> [[-OutputPath] <String>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Retrieves the content of a specific file from the Microsoft Defender XDR Live Response library. Accepts pipeline input from Get-XdrEndpointDeviceLiveResponseLibrary. If -OutputPath is specified, the file is saved to disk. Otherwise the decoded content is returned as a string.
EXAMPLES
EXAMPLE 1
Get-XdrEndpointDeviceLiveResponseLibraryFile -FileName 'PasskeyLogin.ps1'
Returns the content of PasskeyLogin.ps1 as a string.
EXAMPLE 2
Get-XdrEndpointDeviceLiveResponseLibraryFile -FileName 'PasskeyLogin.ps1' -OutputPath 'C:\Temp\PasskeyLogin.ps1'
Downloads and saves the file to disk.
EXAMPLE 3
Get-XdrEndpointDeviceLiveResponseLibrary | Where-Object file_name -eq 'PasskeyLogin.ps1' | Get-XdrEndpointDeviceLiveResponseLibraryFile
Downloads a library file using pipeline input.
PARAMETERS
-FileName
The name of the file to download from the library (e.g. 'PasskeyLogin.ps1'). Accepts ValueFromPipelineByPropertyName, so objects from Get-XdrEndpointDeviceLiveResponseLibrary pipe directly using the file_name property.
Type: String
Parameter Sets: (All)
Aliases: file_name
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-OutputPath
Optional file path to save the downloaded content. If omitted, the content is returned as a string.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.