XDRConverter
2.1.0
PowerShell module for converting Defender XDR detection rules between YAML and JSON formats and deploying them in a GitHub CI/CD pipeline.
Minimum PowerShell version
7.0
Installation Options
Owners
Package Details
Author(s)
- Fabian Bader
Tags
XDR Defender Detection YAML JSON Security MITRE
Functions
ConvertTo-CustomDetectionJson ConvertTo-CustomDetectionYaml Deploy-CustomDetection Get-CustomDetectionIdByDescriptionTag Get-CustomDetectionIdByDetectorId Get-CustomDetectionIds Get-CustomDetection Remove-CustomDetection Test-CustomDetectionMitreTechnique
Dependencies
Release Notes
Version 2.1.0: Add the lookback, eventGroupingKind and isExcludedFromIncidentCorrelation YAML keys, accept more than one tactic per rule, create a rule whose listed id answers NotFound, throw instead of reporting Skipped for a rule deleted in the same session, and list rules without the deprecated detectorId once the API rejects it.
FileList
- XDRConverter.nuspec
- Private\Add-CustomDetectionIdsCacheEntry.ps1
- Private\Assert-MgGraphConnection.ps1
- Private\Clear-CustomDetectionIdsCacheEntry.ps1
- Private\Compare-CustomDetection.ps1
- Private\Complete-CustomDetectionPatchBody.ps1
- Private\ConvertFrom-CustomDetectionAutomatedActions.ps1
- Private\ConvertFrom-CustomDetectionEntityMappings.ps1
- Private\ConvertFrom-CustomDetectionJsonToYaml.ps1
- Private\ConvertFrom-CustomDetectionYamlToJson.ps1
- Private\ConvertTo-CustomDetectionAutomatedActions.ps1
- Private\ConvertTo-CustomDetectionEntityMappings.ps1
- Private\ConvertTo-CustomDetectionFrequency.ps1
- Private\ConvertTo-CustomDetectionHashtable.ps1
- Private\ConvertTo-CustomDetectionIdEntry.ps1
- Private\ConvertTo-CustomDetectionLegacyYaml.ps1
- Private\ConvertTo-CustomDetectionList.ps1
- Private\ConvertTo-CustomDetectionLookback.ps1
- Private\ConvertTo-CustomDetectionOrderedMap.ps1
- Private\ConvertTo-CustomDetectionPlainObject.ps1
- Private\ConvertTo-CustomDetectionStatus.ps1
- Private\ConvertTo-CustomDetectionTactics.ps1
- Private\Get-CustomDetectionActionMap.ps1
- Private\Get-CustomDetectionByClientId.ps1
- Private\Get-CustomDetectionComparableState.ps1
- Private\Get-CustomDetectionDeletedRuleKey.ps1
- Private\Get-CustomDetectionEntityMappingColumns.ps1
- Private\Get-CustomDetectionIdentity.ps1
- Private\Get-CustomDetectionLegacyAction.ps1
- Private\Get-CustomDetectionLegacyIdentifierMap.ps1
- Private\Get-CustomDetectionMitreTechniqueMap.ps1
- Private\Get-CustomDetectionPopulatedEntry.ps1
- Private\Get-CustomDetectionTaggedId.ps1
- Private\Get-CustomDetectionValue.ps1
- Private\Import-CustomDetectionJsonFile.ps1
- Private\Import-CustomDetectionYamlFile.ps1
- Private\Invoke-MgGraphRequestWithRetry.ps1
- Private\Resolve-CustomDetectionOutputFile.ps1
- Private\Resolve-QueryVariables.ps1
- Private\Test-CustomDetectionBadRequest.ps1
- Private\Test-CustomDetectionCollection.ps1
- Private\Test-CustomDetectionListFailure.ps1
- Private\Test-CustomDetectionNotFound.ps1
- Private\Test-CustomDetectionValue.ps1
- Private\Write-CustomDetectionOutput.ps1
- Public\ConvertTo-CustomDetectionJson.ps1
- Public\ConvertTo-CustomDetectionYaml.ps1
- Public\Deploy-CustomDetection.ps1
- Public\Get-CustomDetection.ps1
- Public\Get-CustomDetectionIdByDescriptionTag.ps1
- Public\Get-CustomDetectionIdByDetectorId.ps1
- Public\Get-CustomDetectionIds.ps1
- Public\Remove-CustomDetection.ps1
- Public\Test-CustomDetectionMitreTechnique.ps1
- XDRConverter.psd1
- XDRConverter.psm1