Runs the command in a mode that only reports what would happen without performing the actions.
Parameter properties
Type:
System.Management.Automation.SwitchParameter
Supports wildcards:
False
DontShow:
False
Aliases:
wi
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters.
To create the parameters described below, construct a hash table containing the appropriate properties.
For information on hash tables, run Get-Help about_Hash_Tables.
BODYPARAMETER <IMicrosoftGraphHostSecurityProfile>: hostSecurityProfile
[(Any) <Object>]: This indicates any property can be added to this object.
[Id <String>]: The unique identifier for an entity.
Read-only.
[AzureSubscriptionId <String>]:
[AzureTenantId <String>]:
[FirstSeenDateTime <DateTime?>]:
[Fqdn <String>]:
[IsAzureAdJoined <Boolean?>]:
[IsAzureAdRegistered <Boolean?>]:
[IsHybridAzureDomainJoined <Boolean?>]:
[LastSeenDateTime <DateTime?>]:
[LogonUsers <IMicrosoftGraphLogonUser[]>]:
[AccountDomain <String>]: Domain of user account used to logon.
[AccountName <String>]: Account name of user account used to logon.
[AccountType <String>]: userAccountSecurityType
[FirstSeenDateTime <DateTime?>]: DateTime at which the earliest logon by this user account occurred (provider-determined period).
The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time.
For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
[LastSeenDateTime <DateTime?>]: DateTime at which the latest logon by this user account occurred.
The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time.
For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
[LogonId <String>]: User logon ID.
[LogonTypes <String[]>]: Collection of the logon types observed for the logged on user from when first to last seen.
Possible values are: unknown, interactive, remoteInteractive, network, batch, service.
[NetBiosName <String>]:
[NetworkInterfaces <IMicrosoftGraphNetworkInterface[]>]:
[Description <String>]: Description of the NIC (for example, Ethernet adapter, Wireless LAN adapter Local Area Connection, and so on).
[IPV4Address <String>]: Last IPv4 address associated with this NIC.
[IPV6Address <String>]: Last Public (also known as global) IPv6 address associated with this NIC.
[LocalIPV6Address <String>]: Last local (link-local or site-local) IPv6 address associated with this NIC.
[MacAddress <String>]: MAC address of the NIC on this host.
[OS <String>]:
[OSVersion <String>]:
[ParentHost <String>]:
[RelatedHostIds <String[]>]:
[RiskScore <String>]:
[Tags <String[]>]:
[VendorInformation <IMicrosoftGraphSecurityVendorInformation>]: securityVendorInformation
[(Any) <Object>]: This indicates any property can be added to this object.
[Provider <String>]: Specific provider (product/service - not vendor company); for example, WindowsDefenderATP.
[ProviderVersion <String>]: Version of the provider or subprovider, if it exists, that generated the alert.
Required
[SubProvider <String>]: Specific subprovider (under aggregating provider); for example, WindowsDefenderATP.SmartScreen.
[Vendor <String>]: Name of the alert vendor (for example, Microsoft, Dell, FireEye).
Required
LOGONUSERS <IMicrosoftGraphLogonUser[]>: .
[AccountDomain <String>]: Domain of user account used to logon.
[AccountName <String>]: Account name of user account used to logon.
[AccountType <String>]: userAccountSecurityType
[FirstSeenDateTime <DateTime?>]: DateTime at which the earliest logon by this user account occurred (provider-determined period).
The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time.
For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
[LastSeenDateTime <DateTime?>]: DateTime at which the latest logon by this user account occurred.
The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time.
For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
[LogonId <String>]: User logon ID.
[LogonTypes <String[]>]: Collection of the logon types observed for the logged on user from when first to last seen.
Possible values are: unknown, interactive, remoteInteractive, network, batch, service.
NETWORKINTERFACES <IMicrosoftGraphNetworkInterface[]>: .
[Description <String>]: Description of the NIC (for example, Ethernet adapter, Wireless LAN adapter Local Area Connection, and so on).
[IPV4Address <String>]: Last IPv4 address associated with this NIC.
[IPV6Address <String>]: Last Public (also known as global) IPv6 address associated with this NIC.
[LocalIPV6Address <String>]: Last local (link-local or site-local) IPv6 address associated with this NIC.
[MacAddress <String>]: MAC address of the NIC on this host.
VENDORINFORMATION <IMicrosoftGraphSecurityVendorInformation>: securityVendorInformation
[(Any) <Object>]: This indicates any property can be added to this object.
[Provider <String>]: Specific provider (product/service - not vendor company); for example, WindowsDefenderATP.
[ProviderVersion <String>]: Version of the provider or subprovider, if it exists, that generated the alert.
Required
[SubProvider <String>]: Specific subprovider (under aggregating provider); for example, WindowsDefenderATP.SmartScreen.
[Vendor <String>]: Name of the alert vendor (for example, Microsoft, Dell, FireEye).
Required