Invoke-XdrHuntingQueryValidation
SYNOPSIS
Validates an Advanced Hunting query for custom detection rules in Microsoft Defender XDR.
SYNTAX
Invoke-XdrHuntingQueryValidation [-QueryText] <String> [[-HuntingRule] <Object>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Validates whether an Advanced Hunting query is allowed and checks the permissions required for creating custom detection rules. This is useful before attempting to create a custom detection rule to ensure the query syntax is valid and the user has appropriate permissions.
EXAMPLES
EXAMPLE 1
ago(1h)"
Validates the specified Advanced Hunting query.
EXAMPLE 2
$query = @"
DeviceEvents
| where ActionType == "ProcessCreated"
| where FileName == "powershell.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
"@
Invoke-XdrHuntingQueryValidation -QueryText $query
Validates a multi-line Advanced Hunting query.
EXAMPLE 3
Invoke-XdrHuntingQueryValidation -QueryText "DeviceProcessEvents | where false"
Validates a simple test query that returns no results.
PARAMETERS
-QueryText
The KQL (Kusto Query Language) query text to validate. This should be a valid Advanced Hunting query.
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-HuntingRule
Optional hunting rule object to validate. If not specified, defaults to null.
Type: Object
Parameter Sets: (All)
Aliases:
Required: False
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.