POWERSHELL COMMAND
Get-XdrVulnerabilityManagementRemediationTasks
Retrieves remediation tasks from Vulnerability Management.
Gets remediation task information from the Threat and Vulnerability Management (TVM) in Microsoft Defender XDR. This includes remediation tasks, exceptions, and blocked applications. This function includes caching support with a 30-minute TTL to reduce API calls.
Syntax
Get-XdrVulnerabilityManagementRemediationTasks [-Force] [<CommonParameters>]
Get-XdrVulnerabilityManagementRemediationTasks -Body <Object> [-Force] [-PreRemediation] [<CommonParameters>]
Get-XdrVulnerabilityManagementRemediationTasks [-Force] [-RecommendationExceptions] [<CommonParameters>]
Get-XdrVulnerabilityManagementRemediationTasks [-Force] [-AllExceptions] [<CommonParameters>]
Get-XdrVulnerabilityManagementRemediationTasks [-Force] [-AllExceptionsAggregated] [<CommonParameters>]
Get-XdrVulnerabilityManagementRemediationTasks [-Force] [-BlockedApplications] [<CommonParameters>]
Get-XdrVulnerabilityManagementRemediationTasks [-Force] [-BlockedApplicationsCount] [<CommonParameters>]
Get-XdrVulnerabilityManagementRemediationTasks [-Force] [-BaselineExceptions] [<CommonParameters>]
Parameters
-Force
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Bypasses the cache and forces a fresh retrieval from the API.
-PreRemediation
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves pre-remediation information. This is a POST endpoint.
-RecommendationExceptions
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves recommendation exceptions.
-AllExceptions
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves all exceptions (non-aggregated).
-AllExceptionsAggregated
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves aggregated exceptions data.
-BlockedApplications
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves blocked applications list.
-BlockedApplicationsCount
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves count of blocked applications.
-BaselineExceptions
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Retrieves baseline exceptions from organization settings.
-Body
| Property | Value |
|---|---|
| Type | Object |
| Required | Yes |
| Position | named |
| Pipeline input | No |
| Default | Not documented |
Request body for PreRemediation endpoint (POST request).
Examples
Get-XdrVulnerabilityManagementRemediationTasks
Retrieves all remediation tasks using cached data if available.
Get-XdrVulnerabilityManagementRemediationTasks -Force
Forces a fresh retrieval of remediation tasks, bypassing the cache.
Get-XdrVulnerabilityManagementRemediationTasks -AllExceptionsAggregated
Retrieves aggregated exceptions data.
Get-XdrVulnerabilityManagementRemediationTasks -BlockedApplications
Retrieves list of blocked applications.
$body = @{
groups = @()
modelName = "PreRemediationRequestBodyModel"
preRemediationArgs = @{
category = "SecurityConfiguration"
modelName = "PreRemediationArgsModel"
preRemediationSecurityConfigurationArgs = @{
modelName = "PreRemediationSecurityConfigurationArgsModel"
scid = "scid-79"
taskType = "ConfigurationChange"
}
}
relatedComponent = "deviceMisconfiguration"
}
Get-XdrVulnerabilityManagementRemediationTasks -PreRemediation -Body $body
Submits a pre-remediation request with the specified body.
Output
Type: System.Object[]
Returns an array of remediation task objects from TVM.
System.Int64 When -BlockedApplicationsCount is specified, returns the count as an integer.
System.Management.Automation.PSCustomObject For certain endpoints, returns a summary object.