Get-XdrVulnerabilityManagementVulnerabilities
SYNOPSIS
Retrieves vulnerabilities from Vulnerability Management.
SYNTAX
Default (Default)
Get-XdrVulnerabilityManagementVulnerabilities [-Top <Int32>] [-Force] [-AllVulnerabilities]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
CountOnly
Get-XdrVulnerabilityManagementVulnerabilities [-Force] [-CountOnly] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
Summary
Get-XdrVulnerabilityManagementVulnerabilities [-Force] [-Summary] [-ProgressAction <ActionPreference>]
[<CommonParameters>]
DESCRIPTION
Gets vulnerability information from Threat and Vulnerability Management (TVM) in Microsoft Defender XDR. This function includes caching support with a 30-minute TTL to reduce API calls. By default, only returns vulnerabilities that impact at least one asset, ordered by number of impacted assets (descending).
EXAMPLES
EXAMPLE 1
Get-XdrVulnerabilityManagementVulnerabilities
Retrieves vulnerabilities impacting at least one asset, ordered by impact (most impacted first).
EXAMPLE 2
Get-XdrVulnerabilityManagementVulnerabilities -Top 100
Retrieves the first 100 vulnerabilities impacting at least one asset.
EXAMPLE 3
Get-XdrVulnerabilityManagementVulnerabilities -Force
Forces a fresh retrieval of vulnerabilities impacting at least one asset, bypassing the cache.
EXAMPLE 4
Get-XdrVulnerabilityManagementVulnerabilities -AllVulnerabilities
Retrieves all vulnerabilities without filtering, including those with zero impacted assets.
EXAMPLE 5
Get-XdrVulnerabilityManagementVulnerabilities -CountOnly
Returns only the total number of vulnerabilities.
EXAMPLE 6
Get-XdrVulnerabilityManagementVulnerabilities -Summary
Returns detailed vulnerability summary statistics including total, exploitable, critical, zero-day, and unpatchable counts.
PARAMETERS
-Top
Limits the number of results returned. Valid range is 1-10000.
Type: Int32
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
-Force
Bypasses the cache and forces a fresh retrieval from the API.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-AllVulnerabilities
Returns all vulnerabilities without filtering. By default, only vulnerabilities impacting at least one asset are returned.
Type: SwitchParameter
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-CountOnly
Returns only the total count of vulnerabilities (numOfResults).
Type: SwitchParameter
Parameter Sets: CountOnly
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-Summary
Returns the vulnerability summary from the dedicated summary endpoint. This provides detailed counts including total vulnerabilities, exploitable, critical, zero-day, and unpatchable vulnerabilities without retrieving full vulnerability data.
Type: SwitchParameter
Parameter Sets: Summary
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.