Skip to content

Commit 8d1fee6

Browse files
chrisdachrisda
authored
Merge pull request MicrosoftDocs#1461 from MicrosoftDocs/ATPDocs
ATPDocs to Master
2 parents 9fa49bf + 4ec4cdb commit 8d1fee6

File tree

2 files changed

+437
-0
lines changed

2 files changed

+437
-0
lines changed

‎exchange/exchange-ps/exchange/advanced-threat-protection/Get-AdvancedThreatProtectionDocumentDetail.md

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
---
2+
external help file: Microsoft.Exchange.ServerStatus-Help.xml
3+
applicable: Exchange Online, Exchange Online Protection
4+
title: Get-AdvancedThreatProtectionDocumentDetail
5+
schema: 2.0.0
6+
monikerRange: "exchonline-ps || eop-ps"
7+
---
8+
9+
# Get-AdvancedThreatProtectionDocumentDetail
10+
11+
## SYNOPSIS
12+
This cmdlet is available only in the cloud-based service. Use the Get-AdvancedThreatProtectionDocumentDetailReport cmdlet to view the results of Office 365 Advanced Threat Protection (ATP) actions for files in SharePoint Online, OneDrive for Business and Microsoft Teams in your cloud-based organization. For more information about this feature, see article at: https://go.microsoft.com/fwlink/?linkid=857638
13+
14+
For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax (https://technet.microsoft.com/library/bb123552.aspx).
15+
16+
## SYNTAX
17+
18+
```
19+
Get-AdvancedThreatProtectionDocumentDetail [-Action <MultiValuedProperty>] [-Domain <MultiValuedProperty>] [-EndDate <DateTime>]
20+
[-EventType <MultiValuedProperty>] [-Organization <OrganizationIdParameter>] [-Page <Int32>] [-PageSize <Int32>] [-ProbeTag <String>] [-StartDate <DateTime>] [<CommonParameters>]
21+
```
22+
23+
## DESCRIPTION
24+
For the reporting period and organization you specify, the cmdlet returns the following information:
25+
26+
- Action
27+
- Document Id
28+
- Domain
29+
- Event Type
30+
- File Hash
31+
- File Name
32+
- File Path
33+
- Size
34+
- Timestamp
35+
- Workload
36+
37+
You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet (https://technet.microsoft.com/library/mt432940.aspx).
38+
39+
## EXAMPLES
40+
41+
### -------------------------- Example 1 --------------------------
42+
```
43+
Get-AdvancedThreatProtectionTrafficDetail -Organization contoso.com -StartDate "4/26/2016" -EndDate "4/28/2016" | Format-Table
44+
```
45+
46+
This example returns the detailed report of ATP detections during the specified date range.
47+
48+
## PARAMETERS
49+
50+
### -Action
51+
The Action parameter filters the results by the action taken on the attachment or link. Valid values are:
52+
53+
- Allow
54+
55+
- BlockAccess
56+
57+
```yaml
58+
Type: MultiValuedProperty
59+
Parameter Sets: (All)
60+
Aliases:
61+
Applicable: Exchange Online, Exchange Online Protection
62+
Required: False
63+
Position: Named
64+
Default value: None
65+
Accept pipeline input: False
66+
Accept wildcard characters: False
67+
```
68+
69+
### -Domain
70+
The Domain parameter filters the results by an accepted domain in the cloud-based organization. You can specify multiple domain values separated by commas, or the value All.
71+
72+
```yaml
73+
Type: MultiValuedProperty
74+
Parameter Sets: (All)
75+
Aliases:
76+
Applicable: Exchange Online, Exchange Online Protection
77+
Required: False
78+
Position: Named
79+
Default value: None
80+
Accept pipeline input: True
81+
Accept wildcard characters: False
82+
```
83+
84+
### -EndDate
85+
The EndDate parameter specifies the end date of the date range.
86+
87+
Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks ("), for example, "09/01/2018 5:00 PM".
88+
89+
```yaml
90+
Type: DateTime
91+
Parameter Sets: (All)
92+
Aliases:
93+
Applicable: Exchange Online, Exchange Online Protection
94+
Required: False
95+
Position: Named
96+
Default value: None
97+
Accept pipeline input: False
98+
Accept wildcard characters: False
99+
```
100+
101+
### -EventType
102+
The EventType parameter filters the report by the event type. The event type you specify must correspond to the report. For example, you can only specify "Anti-malware engine" or "Advanced Threat Protection" events for malware reports.
103+
104+
You can specify multiple values separated by commas.
105+
106+
```yaml
107+
Type: MultiValuedProperty
108+
Parameter Sets: (All)
109+
Aliases:
110+
Applicable: Exchange Online, Exchange Online Protection
111+
Required: False
112+
Position: Named
113+
Default value: None
114+
Accept pipeline input: False
115+
Accept wildcard characters: False
116+
```
117+
118+
### -Organization
119+
The Organization parameter specifies the organization for which the report is being presented.
120+
121+
```yaml
122+
Type: OrganizationIdParameter
123+
Parameter Sets: (All)
124+
Aliases:
125+
Applicable: Exchange Online, Exchange Online Protection
126+
Required: True
127+
Position: Named
128+
Default value: None
129+
Accept pipeline input: False
130+
Accept wildcard characters: False
131+
```
132+
133+
### -Page
134+
The Page parameter specifies the page number of the results you want to view. Valid input for this parameter is an integer between 1 and 1000. The default value is 1.
135+
136+
```yaml
137+
Type: Int32
138+
Parameter Sets: (All)
139+
Aliases:
140+
Applicable: Exchange Online, Exchange Online Protection
141+
Required: False
142+
Position: Named
143+
Default value: None
144+
Accept pipeline input: False
145+
Accept wildcard characters: False
146+
```
147+
148+
### -PageSize
149+
The PageSize parameter specifies the maximum number of entries per page. Valid input for this parameter is an integer between 1 and 5000. The default value is 1000.
150+
151+
```yaml
152+
Type: Int32
153+
Parameter Sets: (All)
154+
Aliases:
155+
Applicable: Exchange Online, Exchange Online Protection
156+
Required: False
157+
Position: Named
158+
Default value: None
159+
Accept pipeline input: False
160+
Accept wildcard characters: False
161+
```
162+
163+
### -ProbeTag
164+
This parameter is reserved for internal Microsoft use.
165+
166+
```yaml
167+
Type: String
168+
Parameter Sets: (All)
169+
Aliases:
170+
Applicable: Exchange Online, Exchange Online Protection
171+
Required: False
172+
Position: Named
173+
Default value: None
174+
Accept pipeline input: False
175+
Accept wildcard characters: False
176+
```
177+
178+
### -StartDate
179+
The StartDate parameter specifies the start date of the date range.
180+
181+
Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks ("), for example, "09/01/2018 5:00 PM".
182+
183+
```yaml
184+
Type: DateTime
185+
Parameter Sets: (All)
186+
Aliases:
187+
Applicable: Exchange Online, Exchange Online Protection
188+
Required: False
189+
Position: Named
190+
Default value: None
191+
Accept pipeline input: False
192+
Accept wildcard characters: False
193+
```
194+
195+
### CommonParameters
196+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters (https://go.microsoft.com/fwlink/p/?LinkID=113216).
197+
198+
## INPUTS
199+
200+
###
201+
To see the input types that this cmdlet accepts, see Cmdlet Input and Output Types (https://go.microsoft.com/fwlink/p/?linkId=616387). If the Input Type field for a cmdlet is blank, the cmdlet doesn't accept input data.
202+
203+
## OUTPUTS
204+
205+
###
206+
To see the return types, which are also known as output types, that this cmdlet accepts, see Cmdlet Input and Output Types (https://go.microsoft.com/fwlink/p/?linkId=616387). If the Output Type field is blank, the cmdlet doesn't return data.
207+
208+
## NOTES
209+
210+
## RELATED LINKS
211+
212+
[Online Version](https://docs.microsoft.com/powershell/module/exchange/advanced-threat-protection/get-advancedthreatprotectiondocumentdetail)

0 commit comments

Comments
 (0)