Get-XdrIncident
SYNOPSIS
Retrieves incidents from Microsoft Defender XDR.
SYNTAX
List (Default)
Get-XdrIncident [-TitleSearchTerms <String[]>] [-LookBackInDays <Int32>] [-SortByField <String>]
[-SortOrder <String>] [-PageSize <Int32>] [-PageIndex <Int32>] [-DefenderExpertsLicensed] [-All] [-Force]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
ById
Get-XdrIncident -IncidentId <Int32> [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Gets incidents from Microsoft Defender XDR with support for pagination, sorting, and filtering. This cmdlet translates severity values and detection source IDs to friendly names. Severity translations: 32=Information, 64=Low, 128=Medium, 256=High This function includes caching support with a 10-minute TTL to reduce API calls.
EXAMPLES
EXAMPLE 1
Get-XdrIncident
Retrieves the first 40 incidents from the last 30 days, sorted by TopRisk in descending order.
EXAMPLE 2
Get-XdrIncident -LookBackInDays 7 -PageSize 100
Retrieves the first 100 incidents from the last 7 days.
EXAMPLE 3
Get-XdrIncident -SortByField CreatedDate -SortOrder Ascending
Retrieves incidents sorted by creation date in ascending order (oldest first).
EXAMPLE 4
Get-XdrIncident -TitleSearchTerms "ransomware", "phishing"
Retrieves incidents with titles containing "ransomware" or "phishing".
EXAMPLE 5
Get-XdrIncident -All
Retrieves all incidents by automatically paging through all results.
EXAMPLE 6
Get-XdrIncident -DefenderExpertsLicensed -LookBackInDays 90
Retrieves incidents from the last 90 days for a tenant with Defender Experts license.
EXAMPLE 7
Get-XdrIncident -IncidentId 2823
Retrieves a specific incident by its ID.
EXAMPLE 8
Get-XdrIncident | Where-Object $_.SeverityName -eq "High"
Retrieves incidents and filters for high severity ones.
PARAMETERS
-TitleSearchTerms
Array of search terms to filter incidents by title.
Type: String[]
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-LookBackInDays
Number of days to look back for incidents. Default is 30.
Type: Int32
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: 30
Accept pipeline input: False
Accept wildcard characters: False
-SortByField
Field to sort by. Valid values are: TopRisk, CreatedDate, LastUpdatedDate, Status, severity, name. Default is TopRisk.
Type: String
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: TopRisk
Accept pipeline input: False
Accept wildcard characters: False
-SortOrder
Sort order. Valid values are Ascending or Descending. Default is Descending.
Type: String
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: Descending
Accept pipeline input: False
Accept wildcard characters: False
-PageSize
Number of incidents to retrieve per page. Default is 40.
Type: Int32
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: 40
Accept pipeline input: False
Accept wildcard characters: False
-PageIndex
Page index for pagination. Default is 1.
Type: Int32
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: 1
Accept pipeline input: False
Accept wildcard characters: False
-DefenderExpertsLicensed
Indicates if Microsoft Defender Experts for XDR license is assigned to the tenant. Default is false.
Type: SwitchParameter
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-All
Retrieves all incidents by automatically paging through all results. When specified, PageSize and PageIndex parameters are used for the page size, but pagination is automatic.
Type: SwitchParameter
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: List
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-IncidentId
Retrieves a specific incident by its ID. When specified, all other filtering and pagination parameters are ignored. Cannot be combined with any other parameters.
Type: Int32
Parameter Sets: ById
Aliases:
Required: True
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.