Get-XdrExposureManagementRecommendations
SYNOPSIS
Retrieves recommendations from Exposure Management.
SYNTAX
Default (Default)
Get-XdrExposureManagementRecommendations [-Force] [-Top <Int32>] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
CountOnly
Get-XdrExposureManagementRecommendations [-Force] [-CountOnly] [-Top <Int32>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
Tags
Get-XdrExposureManagementRecommendations [-Force] [-Top <Int32>] [-Tags] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
ActiveVulnerabilities
Get-XdrExposureManagementRecommendations [-Force] [-Top <Int32>] [-ActiveVulnerabilities]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
AllVulnerabilities
Get-XdrExposureManagementRecommendations [-Force] [-Top <Int32>] [-AllVulnerabilities]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
Misconfigurations
Get-XdrExposureManagementRecommendations [-Force] [-Top <Int32>] [-Misconfigurations]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
ByAssets
Get-XdrExposureManagementRecommendations [-Force] [-Top <Int32>] [-ByAssets] -RecommendationId <String>
[-ProgressAction <ActionPreference>] [<CommonParameters>]
ByOperatingSystems
Get-XdrExposureManagementRecommendations [-Force] [-Top <Int32>] [-ByOperatingSystems]
-RecommendationId <String> [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets security recommendations from Microsoft Defender XDR Exposure Management. Supports multiple data sources including TVM recommendations, vulnerability assessments, and device misconfigurations. This function includes caching support with a 30-minute TTL to reduce API calls. By default, returns the recommendations array.
EXAMPLES
EXAMPLE 1
Get-XdrExposureManagementRecommendations
Retrieves all recommendations using cached data if available.
EXAMPLE 2
Get-XdrExposureManagementRecommendations -Force
Forces a fresh retrieval of recommendations, bypassing the cache.
EXAMPLE 3
Get-XdrExposureManagementRecommendations -CountOnly
Returns only the total number of recommendations.
EXAMPLE 4
Get-XdrExposureManagementRecommendations -Top 10
Returns only the first 10 recommendations.
EXAMPLE 5
Get-XdrExposureManagementRecommendations -Tags
Retrieves vulnerability assessment recommendation tags.
EXAMPLE 6
Get-XdrExposureManagementRecommendations -ActiveVulnerabilities
Retrieves vulnerability assessment recommendations with Active or PartialException status.
EXAMPLE 7
Get-XdrExposureManagementRecommendations -AllVulnerabilities
Retrieves all vulnerability assessment recommendations regardless of status.
EXAMPLE 8
Get-XdrExposureManagementRecommendations -Misconfigurations
Retrieves device misconfiguration recommendations.
EXAMPLE 9
Get-XdrExposureManagementRecommendations -ByAssets -RecommendationId "sca-_-scid-69"
Retrieves assets for a specific recommendation.
EXAMPLE 10
Get-XdrExposureManagementRecommendations -ByOperatingSystems -RecommendationId "va-_-microsoft-_-windows_11"
Retrieves operating system breakdown for a specific recommendation.
PARAMETERS
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-CountOnly
Returns only the total count of recommendations (numOfResults).
Type: SwitchParameter
Parameter Sets: CountOnly
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-Top
Limits the number of results returned. Useful for previewing data without fetching all pages.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
-Tags
Retrieves vulnerability assessment recommendation tags.
Type: SwitchParameter
Parameter Sets: Tags
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ActiveVulnerabilities
Retrieves vulnerability assessment recommendations with filters (Active or PartialException status).
Type: SwitchParameter
Parameter Sets: ActiveVulnerabilities
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-AllVulnerabilities
Retrieves all vulnerability assessment recommendations without status filters.
Type: SwitchParameter
Parameter Sets: AllVulnerabilities
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-Misconfigurations
Retrieves device misconfiguration recommendations from the posture/oversight API.
Type: SwitchParameter
Parameter Sets: Misconfigurations
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ByAssets
Retrieves assets for a specific recommendation. Requires -RecommendationId.
Type: SwitchParameter
Parameter Sets: ByAssets
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ByOperatingSystems
Retrieves operating systems for a specific recommendation. Requires -RecommendationId.
Type: SwitchParameter
Parameter Sets: ByOperatingSystems
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-RecommendationId
The recommendation ID required for -ByAssets and -ByOperatingSystems parameters.
Type: String
Parameter Sets: ByAssets, ByOperatingSystems
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.