POWERSHELL COMMAND
Get-XdrXspmChokePoint
Retrieves choke point data from Microsoft Defender XDR XSPM.
Gets choke point information from the XSPM (Extended Security Posture Management) attack surface API. Choke points are critical nodes in the network that appear in multiple attack paths, making them high-value targets for security hardening and monitoring. The results are ordered by risk level (Critical, High, Medium, Low) and attack path count. Supports pagination and can retrieve all available choke points when using the -All parameter. This function includes caching support with a 30-minute TTL to reduce API calls.
Syntax
Get-XdrXspmChokePoint [[-Top] <int>] [[-Skip] <int>] [-All] [-Force] [<CommonParameters>]
Parameters
-Top
| Property | Value |
|---|---|
| Type | Int32 |
| Required | No |
| Position | 1 |
| Pipeline input | No |
| Default | 100 |
The maximum number of choke points to return per page. Default is 100. Ignored when -All is specified.
-Skip
| Property | Value |
|---|---|
| Type | Int32 |
| Required | No |
| Position | 2 |
| Pipeline input | No |
| Default | 0 |
The number of choke points to skip for pagination. Default is 0. Ignored when -All is specified.
-All
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
When specified, retrieves all available choke points by handling pagination automatically.
-Force
| Property | Value |
|---|---|
| Type | SwitchParameter |
| Required | No |
| Position | named |
| Pipeline input | No |
| Default | False |
Bypasses the cache and forces a fresh retrieval from the API.
Examples
Get-XdrXspmChokePoint
Retrieves the first 100 choke points, ordered by risk level and attack path count.
Get-XdrXspmChokePoint -Top 50
Retrieves the first 50 choke points.
Get-XdrXspmChokePoint -Top 100 -Skip 100
Retrieves choke points 101-200 (pagination).
Get-XdrXspmChokePoint -All
Retrieves all available choke points by automatically handling pagination.
Get-XdrXspmChokePoint -All -Force
Retrieves all choke points, bypassing the cache.
Output
Type: Array
Returns an array of choke point objects containing node information, attack path counts, and risk levels.