Skip to main content

Set-XdrAdvancedHuntingFunction

SYNOPSIS​

Updates an existing Advanced Hunting function in Microsoft Defender XDR.

SYNTAX​

Parameters (Default)​

Set-XdrAdvancedHuntingFunction -Id <Int32> [-Name <String>] [-KQLQuery <String>] [-Description <String>]
 [-IsShared] [-FolderPath <String>] [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm]
 [<CommonParameters>]

InputObject​

Set-XdrAdvancedHuntingFunction -InputObject <Object> [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm]
 [<CommonParameters>]

DESCRIPTION​

Updates a saved function for Advanced Hunting queries in Microsoft Defender XDR. The function must exist before it can be updated. The cmdlet will verify the function exists before attempting the update.

EXAMPLES​

EXAMPLE 1​

Set-XdrAdvancedHuntingFunction -Id 6 -Name "UpdatedFunctionName"
Updates the name of function with ID 6.

EXAMPLE 2​

Set-XdrAdvancedHuntingFunction -Id 6 -KQLQuery $newQuery -Description "Updated description"
Updates the query and description of a function.

EXAMPLE 3​

$function = Get-XdrAdvancedHuntingFunction -Id 6
$function.IsShared = $false
Set-XdrAdvancedHuntingFunction -InputObject $function
Gets a function, modifies it, and updates it.

EXAMPLE 4​

Set-XdrAdvancedHuntingFunction -Id 6 -IsShared -FolderPath "NewFolder/SubFolder"
Makes a function shared and moves it to a new folder path.

PARAMETERS​

-Id​

The ID of the function to update. This is mandatory to ensure the correct function is updated.

Type: Int32
Parameter Sets: Parameters
Aliases:

Required: True
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

-Name​

The new name of the function. If not specified, the existing name is preserved.

Type: String
Parameter Sets: Parameters
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-KQLQuery​

The new KQL (Kusto Query Language) body of the function. If not specified, the existing query is preserved.

Type: String
Parameter Sets: Parameters
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Description​

The new description of the function. If not specified, the existing description is preserved.

Type: String
Parameter Sets: Parameters
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-IsShared​

Switch to make the function shared with the organization. If not specified, the existing sharing status is preserved.

Type: SwitchParameter
Parameter Sets: Parameters
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-FolderPath​

The new folder path for organizing the function. Use forward slashes (/) or backslashes (\) - they will be automatically converted to double backslashes. If not specified, the existing path is preserved.

Type: String
Parameter Sets: Parameters
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-InputObject​

PSObject containing the function to update. The object must include an Id property. Typically obtained from Get-XdrAdvancedHuntingFunction.

Type: Object
Parameter Sets: InputObject
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False

-WhatIf​

Shows what would happen if the cmdlet runs. The function is not created.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm​

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

Object​

Returns the updated function object from the API.​

NOTES​

The function must exist before it can be updated. All unspecified parameters will preserve their existing values.