API Reference
Class
AsrRules
Utility helpers for Microsoft Defender Attack Surface Reduction (ASR) rules. Provides a built‑in mapping from ASR rule GUIDs to friendly names and helpers to format configured actions (Block/Audit/Warn/Off).
Inheritance
- Object
- AsrRules
Methods
public static String FormatAction(Nullable<UInt32> value) #Returns:
StringFormats the numeric action value from policy to a friendly label.
Parameters
- value System.Nullable{System.UInt32}
- Action DWORD: 0=Off/Not configured, 1=Block, 2=Audit, 6=Warn; null when not set.
Returns
"Block", "Audit", "Warn", or "Off".
public static IEnumerable<String> GetAllRuleIds() #Returns:
IEnumerable<String>Returns normalized (lowercase, no braces) RuleId keys known to the map.
public static IEnumerable<ValueTuple<String, String>> GetAllRules() #Returns:
IEnumerable<ValueTuple<String, String>>Returns all known rules as (Id, Name) pairs.
public static String GetName(String ruleId) #Returns:
StringReturns the friendly rule name for a given ASR rule identifier.
Parameters
- ruleId System.String
- Rule GUID (with or without braces; any casing).
Returns
Friendly name when known; otherwise the original ruleId.
public static Boolean IsKnown(String ruleId) #Returns:
BooleanTrue when the specified RuleId is recognized in the map (any casing, braces allowed).
Parameters
- ruleId System.String