Get-MpThreatDetection

Get-MpThreatDetection

Gets active and past malware threats that Windows Defender detected.

Syntax

Parameter Set: ById
Get-MpThreatDetection [-AsJob] [-CimSession <CimSession[]> ] [-ThreatID <Int64[]> ] [-ThrottleLimit <Int32> ] [ <CommonParameters>]

Detailed Description

The Get-MpThreatDetection cmdlet gets active and past malware threats that Windows Defender detected on the computer. If Windows Defender has detected the threat that you specify, the cmdlet returns a list that shows each time Windows Defender detected the threat.

Parameters

-AsJob

Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

-CimSession<CimSession[]>

Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.

Aliases

Session

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

-ThreatID<Int64[]>

Specifies an array of threat IDs. The cmdlet gets the threats that you specify.

Aliases

ID

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

-ThrottleLimit<Int32>

Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.

Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

<CommonParameters>

This cmdlet supports the common parameters: -Verbose, -Debug, -ErrorAction, -ErrorVariable, -OutBuffer, and -OutVariable. For more information, see    about_CommonParameters (https://go.microsoft.com/fwlink/p/?LinkID=113216).

Inputs

The input type is the type of the objects that you can pipe to the cmdlet.

Outputs

The output type is the type of the objects that the cmdlet emits.

Examples

Example 1: Get threats that Windows Defender detected

This command returns the list of past malware detections for the local computer.

PS C:\> Get-MpThreatDetection

Get-MpThreat

Remove-MpThreat

Get-MpThreatCatalog