POWERSHELL COMMAND
Get-XdrVulnerabilityManagementCertificates
Retrieves certificates from Vulnerability Management.
Gets certificate inventory data from TVM in Microsoft Defender XDR. This includes information about server certificates, machine certificates, certificate issues, and issuers. This function includes caching support with a 30-minute TTL to reduce API calls.
Syntax
Get-XdrVulnerabilityManagementCertificates [-Force] [-Top <int>] [<CommonParameters>]
Get-XdrVulnerabilityManagementCertificates [-Force] [-Top <int>] [-ServerCertificateIssues] [<CommonParameters>]
Get-XdrVulnerabilityManagementCertificates [-Force] [-Top <int>] [-MachineCertificateIssues] [<CommonParameters>]
Get-XdrVulnerabilityManagementCertificates [-Force] [-Top <int>] [-PrivateCaCertificateIssues] [<CommonParameters>]
Get-XdrVulnerabilityManagementCertificates [-Force] [-Top <int>] [-ServerIssuers] [<CommonParameters>]
Get-XdrVulnerabilityManagementCertificates [-Force] [-Top <int>] [-MachineIssuers] [<CommonParameters>]
Get-XdrVulnerabilityManagementCertificates [-Force] [-Top <int>] [-CountOnly] [<CommonParameters>]
Get-XdrVulnerabilityManagementCertificates [-Force] [-Top <int>] [-CountByExpirationDate] [<CommonParameters>]
Get-XdrVulnerabilityManagementCertificates [-Force] [-Top <int>] [-AggregatedMachineCertificates] [<CommonParameters>]
Parameters
-Force
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Bypasses the cache and forces a fresh retrieval from the API.
-Top
| Property | Value |
|---|---|
| Type | Int32 |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | 0 |
Limits the number of results returned for paginated endpoints. Useful for previewing data.
-ServerCertificateIssues
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves server certificate issues.
-MachineCertificateIssues
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves machine certificate issues.
-PrivateCaCertificateIssues
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves private CA certificate issues.
-ServerIssuers
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves server certificate issuers.
-MachineIssuers
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves machine certificate issuers.
-CountOnly
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves only the total count of certificates.
-CountByExpirationDate
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves certificate count grouped by expiration date.
-AggregatedMachineCertificates
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves aggregated machine certificate data from the aggregatedCertificate endpoint.
Examples
Get-XdrVulnerabilityManagementCertificates
Retrieves all certificates using cached data if available.
Get-XdrVulnerabilityManagementCertificates -Force
Forces a fresh retrieval of certificate inventory, bypassing the cache.
Get-XdrVulnerabilityManagementCertificates -Top 10
Retrieves only the first 10 certificates.
Get-XdrVulnerabilityManagementCertificates -ServerCertificateIssues
Retrieves server certificate issues.
Get-XdrVulnerabilityManagementCertificates -CountOnly
Returns only the total count of certificates.
Get-XdrVulnerabilityManagementCertificates -AggregatedMachineCertificates
Retrieves aggregated machine certificate data.
Output
Type: System.Object[]
Returns an array of certificate objects for paginated endpoints.
System.Int64 When -CountOnly is specified, returns the total count as an integer.
System.Management.Automation.PSCustomObject Returns a single object for non-paginated endpoints (issues, issuers, counts).
Suppress false positive: Switch parameters are used via $PSCmdlet.ParameterSetName, not direct reference