Get-XdrThreatAnalyticsOutbreaks
SYNOPSIS
Retrieves threat analytics outbreaks from Microsoft Defender XDR.
SYNTAX
Default (Default)
Get-XdrThreatAnalyticsOutbreaks [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]
ChangeCount
Get-XdrThreatAnalyticsOutbreaks [-Force] [-ChangeCount] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
TopThreats
Get-XdrThreatAnalyticsOutbreaks [-Force] [-TopThreats] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
DESCRIPTION
Gets threat analytics outbreaks data from the Microsoft Defender XDR portal. This function includes caching support with a 30-minute TTL to reduce API calls.
By default, retrieves the full outbreaks list. Use -ChangeCount or -TopThreats switches to retrieve specific outbreak metrics from dedicated endpoints.
EXAMPLES
EXAMPLE 1
Get-XdrThreatAnalyticsOutbreaks
Retrieves threat analytics outbreaks using cached data if available.
EXAMPLE 2
Get-XdrThreatAnalyticsOutbreaks -Force
Forces a fresh retrieval of threat analytics outbreaks, bypassing the cache.
EXAMPLE 3
Get-XdrThreatAnalyticsOutbreaks -ChangeCount
Retrieves the outbreak change count metrics from the dedicated endpoint.
EXAMPLE 4
Get-XdrThreatAnalyticsOutbreaks -TopThreats
Retrieves the top threats from outbreaks, prioritized by significance.
EXAMPLE 5
Get-XdrThreatAnalyticsOutbreaks -TopThreats -Force
Forces a fresh retrieval of top threats, bypassing the cache.
PARAMETERS
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ChangeCount
Returns the outbreak change count information using the dedicated /changeCount endpoint. This provides metrics about changes in outbreak data over time.
Type: SwitchParameter
Parameter Sets: ChangeCount
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-TopThreats
Returns the top threats from outbreaks using the dedicated /topThreats endpoint. This provides a prioritized list of the most significant threats.
Type: SwitchParameter
Parameter Sets: TopThreats
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.