POWERSHELL COMMAND
Get-XdrExposureManagementRecommendations
Retrieves recommendations from Exposure Management.
Gets security recommendations from Microsoft Defender XDR Exposure Management. Supports multiple data sources including TVM recommendations, vulnerability assessments, and device misconfigurations. This function includes caching support with a 30-minute TTL to reduce API calls. By default, returns the recommendations array.
Syntax
Get-XdrExposureManagementRecommendations [-Force] [-Top <int>] [<CommonParameters>]
Get-XdrExposureManagementRecommendations [-Force] [-CountOnly] [-Top <int>] [<CommonParameters>]
Get-XdrExposureManagementRecommendations [-Force] [-Top <int>] [-Tags] [<CommonParameters>]
Get-XdrExposureManagementRecommendations [-Force] [-Top <int>] [-ActiveVulnerabilities] [<CommonParameters>]
Get-XdrExposureManagementRecommendations [-Force] [-Top <int>] [-AllVulnerabilities] [<CommonParameters>]
Get-XdrExposureManagementRecommendations [-Force] [-Top <int>] [-Misconfigurations] [<CommonParameters>]
Get-XdrExposureManagementRecommendations -RecommendationId <string> [-Force] [-Top <int>] [-ByAssets] [<CommonParameters>]
Get-XdrExposureManagementRecommendations -RecommendationId <string> [-Force] [-Top <int>] [-ByOperatingSystems] [<CommonParameters>]
Parameters
-Force
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Bypasses the cache and forces a fresh retrieval from the API.
-CountOnly
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Returns only the total count of recommendations (numOfResults).
-Top
| Property | Value |
|---|---|
| Type | Int32 |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | 0 |
Limits the number of results returned. Useful for previewing data without fetching all pages.
-Tags
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves vulnerability assessment recommendation tags.
-ActiveVulnerabilities
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves vulnerability assessment recommendations with filters (Active or PartialException status).
-AllVulnerabilities
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves all vulnerability assessment recommendations without status filters.
-Misconfigurations
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves device misconfiguration recommendations from the posture/oversight API.
-ByAssets
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves assets for a specific recommendation. Requires -RecommendationId.
-ByOperatingSystems
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves operating systems for a specific recommendation. Requires -RecommendationId.
-RecommendationId
| Property | Value |
|---|---|
| Type | String |
| Required | Yes |
| Position | named |
| Pipeline input | No |
| Default | Not documented |
The recommendation ID required for -ByAssets and -ByOperatingSystems parameters.
Examples
Get-XdrExposureManagementRecommendations
Retrieves all recommendations using cached data if available.
Get-XdrExposureManagementRecommendations -Force
Forces a fresh retrieval of recommendations, bypassing the cache.
Get-XdrExposureManagementRecommendations -CountOnly
Returns only the total number of recommendations.
Get-XdrExposureManagementRecommendations -Top 10
Returns only the first 10 recommendations.
Get-XdrExposureManagementRecommendations -Tags
Retrieves vulnerability assessment recommendation tags.
Get-XdrExposureManagementRecommendations -ActiveVulnerabilities
Retrieves vulnerability assessment recommendations with Active or PartialException status.
Get-XdrExposureManagementRecommendations -AllVulnerabilities
Retrieves all vulnerability assessment recommendations regardless of status.
Get-XdrExposureManagementRecommendations -Misconfigurations
Retrieves device misconfiguration recommendations.
Get-XdrExposureManagementRecommendations -ByAssets -RecommendationId "sca-_-scid-69"
Retrieves assets for a specific recommendation.
Get-XdrExposureManagementRecommendations -ByOperatingSystems -RecommendationId "va-_-microsoft-_-windows_11"
Retrieves operating system breakdown for a specific recommendation.
Output
Type: System.Object[]
Returns an array of recommendation objects. Output varies based on parameters used.
System.Int64 When -CountOnly is specified, returns the total count as an integer.
Suppress false positive: Switch parameters are used via $PSCmdlet.ParameterSetName, not direct reference