Get-XdrIdentityAlertThreshold
SYNOPSIS
Retrieves alert threshold configuration for Microsoft Defender for Identity.
SYNTAX
Get-XdrIdentityAlertThreshold [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets the alert threshold settings for Microsoft Defender for Identity detections. Alert thresholds determine the sensitivity level (High/Medium/Low) for various security alerts. The function maps internal alert names to user-friendly titles for better readability. This function includes caching support with a 30-minute TTL to reduce API calls.
EXAMPLES
EXAMPLE 1
Get-XdrIdentityAlertThreshold
Retrieves the alert threshold configuration using cached data if available.
EXAMPLE 2
Get-XdrIdentityAlertThreshold -Force
Forces a fresh retrieval of the alert threshold configuration, bypassing the cache.
EXAMPLE 3
$thresholds = Get-XdrIdentityAlertThreshold
$thresholds | Where-Object $_.Threshold -eq "Low"
Retrieves all alerts configured with Low threshold.
EXAMPLE 4
Get-XdrIdentityAlertThreshold | Format-Table AlertTitle, Threshold, AvailableThresholds -AutoSize
Displays alert thresholds in a formatted table.
PARAMETERS
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.