Skip to main content

Get-XdrXspmTopTarget

SYNOPSIS​

Retrieves top targets from Microsoft Defender XDR XSPM attack paths.

SYNTAX​

Get-XdrXspmTopTarget [[-Top] <Int32>] [-Force] [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Gets the top targets from active and new attack paths in the XSPM (Extended Security Posture Management) API. Targets are the critical assets that attackers are attempting to compromise through attack paths. Results are summarized by target ID and ordered by the number of attack paths targeting each asset. Returns the top 3 targets by default. This function includes caching support with a 30-minute TTL to reduce API calls.

EXAMPLES​

EXAMPLE 1​

Get-XdrXspmTopTarget
Retrieves the top 3 targets from active and new attack paths.

EXAMPLE 2​

Get-XdrXspmTopTarget -Top 10
Retrieves the top 10 targets from active and new attack paths.

EXAMPLE 3​

Get-XdrXspmTopTarget -Force
Retrieves the top targets, bypassing the cache.

PARAMETERS​

-Top​

The maximum number of top targets to return. Default is 3. Note: The query includes "top N" logic embedded.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: 10
Accept pipeline input: False
Accept wildcard characters: False

-Force​

Bypasses the cache and forces a fresh retrieval from the API.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

Array​

Returns an array of target objects containing TargetId, TargetName, and count (number of attack paths).​

NOTES​