MicrosoftGraphFilesStandardConnector

This integration is configured automatically as part of the O365 File Management (Onedrive/Sharepoint/Teams) Standard Connector. Do not configure this integration directly — set it up from the connector page instead.

Email · Microsoft Graph Files (Standard Connector)

Details

IDMicrosoftGraphFilesStandardConnector
ProviderMicrosoft
CategoryEmail
From Version8.15.0
Docker Imagedemisto/crypto:1.0.0.10120494
Supported ModulesAgentix Cloud Runtime Security XSIAM EDR Cortex Cloud

README

Use the O365 File Management (Onedrive/Sharepoint/Teams) integration to enable your app to get authorized access to files in OneDrive, SharePoint, and MS Teams across your entire organization. This integration requires admin consent.

Authentication

For more details about the authentication used in this integration, see Microsoft Integrations - Authentication.

Required Permissions

The required permission depends on whether you want to access all sites (Sites.ReadWrite.All) or specific sites (Site.Selected):

  • Sites.ReadWrite.All: Provides read and write access to all sites.
    Client Credentials Flow - Application permission.
    Authorization Code Flow - Delegated permission.

Note: This permission is sufficient for all the commands, but if you want the least privileged permissions for each command, they are listed for each command definition.

OR

  • Sites.Selected - Application: Provides read and write access to specific sites.
    This option is not supported with the Authorization Code Flow according to Microsoft documentation.

Note: Using Site.Selected requires additional configuration steps outlined below.

Steps to use the Site.Selected permission

Two applications and two instances are required, one for the administrator and one for the user.

Configuration:

  1. In the Microsoft website:
    1. Create “Admin” application with the Sites.FullControl.All permission.
    2. Create “User” application with the Site.Selected - Application permission.
  2. In Cortex XSOAR, navigate to Settings > Integrations.
  3. Search for O365 File Management (Onedrive/Sharepoint/Teams).
  4. Create an admin instance:
    1. Click Add instance to create and configure a new integration instance.
    2. Enter the admin application credentials.
    3. Click Test to validate the connection.
    4. Use the following commands to give the user application access to specific sites:
      • msgraph-list-site-permissions - Get permissions for a site
      • msgraph-create-site-permissions - Add permissions for a site
      • msgraph-update-site-permissions - Update permissions for a site
      • msgraph-delete-site-permissions - Delete permissions for a site
    5. Delete the admin instance after configuring user access.
  5. Create a user instance:
    1. Click Add instance to create and configure a new integration instance.
    2. Enter the user application credentials.
    3. Click Test to validate the connection.

Note: The msgraph-list-sharepoint-sites command cannot be run, as it requires the Sites.Read.All - Application permission.

Configure O365 File Management (Onedrive/Sharepoint/Teams) on Cortex XSOAR

  1. Navigate to Settings > Integrations.
  2. Search for O365 File Management (Onedrive/Sharepoint/Teams).

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    Server URL   True
    Application ID / Client ID   False
    Token / Tenant ID   False
    Key / Client Secret   False
    Application redirect URI (for Self Deployed - Authorization Code Flow)   False
    Authorization code (for Self Deployed - Authorization Code Flow)   False
    Certificate Thumbprint Used for certificate authentication. As appears in the “Certificates & secrets” page of the app. False
    Private Key Used for certificate authentication. The private key of the registered certificate. False
    Use a self-deployed Azure Application Select this checkbox if you are using a self-deployed Azure application. False
    Use Azure Managed Identities Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. False
    Azure Managed Identities Client ID The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. False
    Trust any certificate (not secure)   False
    Use system proxy settings   False
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msgraph-delete-file

Deletes an item from OneDrive.

Base Command

msgraph-delete-file

Required Permissions

Client Credentials Flow - Files.ReadWrite.All - Application
Authorization Code Flow - Files.ReadWrite.All - Delegated

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drive’: To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
For resource type ‘group’: To get a list of all groups that exists, configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: To get a list of all sites, use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: To get a list of all users that exists, configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The ID of the item to delete.
To get the ID of the file you want to delete, use the msgraph-list-drive-content command.		 Required

Context Output

There is no context output for this command.

Command Example

!msgraph-delete-file object_type=drives object_type_id=test item_id=test

Human Readable Output

123
Item was deleted successfully

msgraph-upload-new-file

Uploads a file from Cortex XSOAR to the specified MS Graph resource.

Base Command

msgraph-upload-new-file

Required Permissions

Client Credentials Flow - Sites.ReadWrite.All - Application
Authorization Code Flow - Files.ReadWrite.All - Delegated

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, users, sites. Required
object_type_id MS Graph resource ID.
For resource type ‘drive’: To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
For resource type ‘group’: To get a list of all groups that exists, configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: To get a list of all sites, use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: To get a list of all users that exists, configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
parent_id The ID of the folder in which to upload the file.
To get the ID of a folder, use the msgraph-list-drive-content command.		 Required
file_name The name of the file to upload. Required
entry_id The Cortex XSOAR entry ID of the file. Required

Context Output

Path Type Description
MsGraphFiles.UploadedFiles.ParentReference.DriveId String Unique identifier of the drive that contains the item.
MsGraphFiles.UploadedFiles.ParentReference.DriveType String Identifies the drive type.
MsGraphFiles.UploadedFiles.ParentReference.ID String Unique identifier of the item in the drive.
MsGraphFiles.UploadedFiles.ParentReference.Path String The path of the item.
MsGraphFiles.UploadedFiles.LastModifiedDateTime String The timestamp of when the item was last modified.
MsGraphFiles.UploadedFiles.File.MimeType String The file type.
MsGraphFiles.UploadedFiles.File.Hashes String The file hash type.
MsGraphFiles.UploadedFiles.CreatedDateTime String The timestamp of when the item was created.
MsGraphFiles.UploadedFiles.WebUrl String The URL of the resource in the browser.
MsGraphFiles.UploadedFiles.OdataContext String The OData query.
MsGraphFiles.UploadedFiles.FileSystemInfo.CreatedDateTime String The timestamp of when the item was created on a client.
MsGraphFiles.UploadedFiles.FileSystemInfo.LastModifiedDateTime String The timestamp of when the item was last modified on a client.
MsGraphFiles.UploadedFiles.LastModifiedBy.DisplayName String The item display name.
MsGraphFiles.UploadedFiles.LastModifiedBy.Type String The application, user, or device that last modified the item.
MsGraphFiles.UploadedFiles.CreatedBy.DisplayName String The identity of the user, device, or application that created the item.
MsGraphFiles.UploadedFiles.CreatedBy.ID String The ID of the creator.
MsGraphFiles.UploadedFiles.CreatedBy.Type String The application, user, or device that created the item.
MsGraphFiles.UploadedFiles.DownloadUrl String The URL to download this file’s content.
MsGraphFiles.UploadedFiles.Size Number The file size.
MsGraphFiles.UploadedFiles.ID String The file ID.
MsGraphFiles.UploadedFiles.Name String The file name.
MsGraph.UploadedFiles.File String The MS Graph file object.

Command Example

!msgraph-upload-new-file object_type=drives object_type_id=123 parent_id=123 file_name="test.txt" entry_id=123

Context Example
{
    "MsGraphFiles.UploadedFiles": {
        "ParentReference": {
            "DriveId": "test",
            "DriveType": "documentLibrary",
            "ID": "test",
            "Path": "test"
        },
        "LastModifiedBy": {
            "Type": "Application",
            "DisplayName": "Microsoft Graph",
            "ID": "test"
        },
        "LastModifiedDateTime": "2020-01-22T20:03:00Z",
        "CreatedBy": {
            "Type": "Application",
            "DisplayName": "Microsoft Graph",
            "ID": "test"
        },
        "CreatedDateTime": "2020-01-22T20:03:00Z",
        "WebUrl": "test",
        "FileSystemInfo": {
            "CreatedDateTime": "2020-01-22T20:03:00Z",
            "LastModifiedDateTime": "2020-01-22T20:03:00Z"
        },
        "DownloadUrl": "test",
        "File": {
            "MimeType": "text/plain",
            "Hashes": {
                "QuickXorHash": "test"
            }
        },
        "OdataContext": "test",
        "Size": 15,
        "ID": "test",
        "Name": "test.txt"
    }
}

Human Readable Output

CreatedBy CreatedDateTime ID LastModifiedBy Name Size WebUrl
Microsoft Graph 2020-01-22T20:03:00Z Test Microsoft Graph test.txt 15 Test

msgraph-replace-existing-file

Replaces the content of the file in the specified MS Graph resource.

Base Command

msgraph-replace-existing-file

Required Permissions

Client Credentials Flow - Sites.ReadWrite.All - Application
Authorization Code Flow - Files.ReadWrite.All - Delegated

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drive’: To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
For resource type ‘group’: To get a list of all groups that exists, configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: To get a list of all sites, use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: To get a list of all users that exists, configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The MS Graph item ID of the file you want to replace.
To get the ID of the file you want to replace, use the msgraph-list-drive-content command.		 Required
entry_id The Cortex XSOAR entry ID of the new file that will replace the current file. Required

Context Output

Path Type Description
MsGraphFiles.ReplacedFiles.ParentReference.DriveId String Unique identifier of the drive that contains the item.
MsGraphFiles.ReplacedFiles.ParentReference.DriveType String The drive type.
MsGraphFiles.ReplacedFiles.ParentReference.ID String Unique identifier of the item in the drive.
MsGraphFiles.ReplacedFiles.ParentReference.Path String The path of the item.
MsGraphFiles.ReplacedFiles.LastModifiedDateTime Date Timestamp of when the item was last modified.
MsGraphFiles.ReplacedFiles.File.MimeType String The file type.
MsGraphFiles.ReplacedFiles.File.Hashes String The file hash type.
MsGraphFiles.ReplacedFiles.CreatedDateTime String Timestamp of when the item was created.
MsGraphFiles.ReplacedFiles.WebUrl String URL to the resource in the browser.
MsGraphFiles.ReplacedFiles.OdataContext String The OData query.
MsGraphFiles.ReplacedFiles.FileSystemInfo.CreatedDateTime Date Timestamp of when the item was created on a client.
MsGraphFiles.ReplacedFiles.FileSystemInfo.LastModifiedDateTime Date Timestamp of when the item was last modified on a client.
MsGraphFiles.ReplacedFiles.LastModifiedBy.DisplayName String The item display name.
MsGraphFiles.ReplacedFiles.LastModifiedBy.ID String Identity of the application that last modified the item.
MsGraphFiles.ReplacedFiles.CreatedBy.DisplayName String Identity of the user, device, or application that created the item.
MsGraphFiles.ReplacedFiles.CreatedBy.ID String The ID of the creator.
MsGraphFiles.ReplacedFiles.CreatedBy.Type String Application, user, or device.
MsGraphFiles.ReplacedFiles.DownloadUrl String URL to download the file’s content.
MsGraphFiles.ReplacedFiles.Size Number File’s size.
MsGraphFiles.ReplacedFiles.Id String The file ID.
MsGraphFiles.ReplacedFiles.Name String The file name.
MsGraphFiles.ReplacedFiles.File String The MS Graph file object.

Command Example

!msgraph-replace-existing-file object_type=drives entry_id=test item_id=test object_type_id=test

Context Example
{
    "MsGraphFiles.ReplacedFiles": {
        "ParentReference": {
            "DriveId": "test",
            "DriveType": "documentLibrary",
            "ID": "test",
            "Path": "test"
        },
        "LastModifiedBy": {
            "Type": "Application",
            "DisplayName": "Microsoft Graph",
            "ID": "test"
        },
        "LastModifiedDateTime": "2020-01-22T20:03:06Z",
        "CreatedBy": {
            "Type": "Application",
            "DisplayName": "SharePoint DEV",
            "ID": "test"
        },
        "CreatedDateTime": "2020-01-05T15:30:21Z",
        "WebUrl": "test",
        "FileSystemInfo": {
            "CreatedDateTime": "2020-01-05T15:30:21Z",
            "LastModifiedDateTime": "2020-01-22T20:03:06Z"
        },
        "DownloadUrl": "test",
        "File": {
            "MimeType": "text/plain",
            "Hashes": {
                "QuickXorHash": "test"
            }
        },
        "OdataContext": "test",
        "Size": 15,
        "ID": "test",
        "Name": "test.txt"
    }
}

Human Readable Output

MsGraphFiles - File information

Created By Created Date Time ID Last Modified By Name Size Web Url
SharePoint DEV 2020-01-05T15:30:21Z 123 Microsoft Graph yaya.txt 15 123

msgraph-create-new-folder

Creates a new folder in a drive with the specified parent item or path.

Base Command

msgraph-create-new-folder

Required Permissions

Client Credentials Flow - Files.ReadWrite.All - Application
Authorization Code Flow - Files.ReadWrite.All - Delegated

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drive’: To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
For resource type ‘group’: To get a list of all groups that exists, configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: To get a list of all sites, use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: To get a list of all users that exists, configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
parent_id The ID of the parent in which to upload the new folder.
Parent can be either ‘root’ or another folder.
To get the required folder ID, use the msgraph-list-drive-content command.		 Required
folder_name The name of the new folder. Required

Context Output

Path Type Description
MsGraph.Folder Unknown The MS Graph folder object.
Msgraphfiles.CreatedFolder.ParentReference.DriveId String Unique identifier of the drive that contains the item.
Msgraphfiles.CreatedFolder.ParentReference.DriveType String The drive type.
Msgraphfiles.CreatedFolder.ParentReference.ID String Unique identifier of the item in the drive.
Msgraphfiles.CreatedFolder.ParentReference.Path String The path to the item.
Msgraphfiles.CreatedFolder.LastModifiedDateTime Date Timestamp of when the item was last modified.
Msgraphfiles.CreatedFolder.Name String The folder name.
Msgraphfiles.CreatedFolder.CreatedDateTime Date Timestamp of when the item was created.
Msgraphfiles.CreatedFolder.WebUrl String URL to the resource in the browser.
Msgraphfiles.CreatedFolder.OdataContext String The OData query.
Msgraphfiles.CreatedFolder.FileSystemInfo.CreatedDateTime Date Timestamp of when the item was created on a client.
Msgraphfiles.CreatedFolder.FileSystemInfo.LastModifiedDateTime Date Timestamp of when the item was last modified on a client.
Msgraphfiles.CreatedFolder.LastModifiedBy.DisplayName String The item display name.
Msgraphfiles.CreatedFolder.LastModifiedBy.ID String Identity of the application that last modified the item.
Msgraphfiles.CreatedFolder.CreatedBy.DisplayName String Identity of the user, device,or application that created the item.
Msgraphfiles.CreatedFolder.CreatedBy.ID String The ID of the creator.
Msgraphfiles.CreatedFolder.ChildCount Number The number of sub-items in the folder.
Msgraphfiles.CreatedFolder.ID String The folder ID.
Msgraphfiles.CreatedFolder.Size Number The folder size.

Command Example

!msgraph-create-new-folder object_type=drives object_type_id=123 parent_id=123 folder_name=test11

Context Example
{
    "MsGraphFiles.CreatedFolders": {
        "ParentReference": {
            "DriveId": "test",
            "DriveType": "documentLibrary",
            "ID": "test",
            "Path": "test"
        },
        "OdataContext": "test",
        "LastModifiedDateTime": "2020-01-22T20:03:09Z",
        "Name": "test11 19",
        "CreatedDateTime": "2020-01-22T20:03:09Z",
        "WebUrl": "test",
        "FileSystemInfo": {
            "CreatedDateTime": "2020-01-22T20:03:09Z",
            "LastModifiedDateTime": "2020-01-22T20:03:09Z"
        },
        "LastModifiedBy": {
            "Type": "Application",
            "DisplayName": "Microsoft Graph",
            "ID": "test"
        },
        "CreatedBy": {
            "Type": "Application",
            "DisplayName": "Microsoft Graph",
            "ID": "test"
        },
        "Folder": {
            "ChildCount": 0
        },
        "ID": "test",
        "Size": 0
    }
}

Human Readable Output

MsGraphFiles - Folder information

Child Count Created By Created Date Time ID Last Modified By Name Size Web Url
ChildCount: 0 Microsoft Graph 2020-01-22T20:03:09Z 123 Microsoft Graph test11 19 0 123

msgraph-list-drives-in-site

Returns the list of document libraries (drives) available for a target site.

Base Command

msgraph-list-drives-in-site

Required Permissions

Client Credentials Flow - Files.Read.All - Application
Authorization Code Flow - Files.Read - Delegated

Input

Argument Name Description Required
site_id The ID of the site for which to return available drive resources.
To find a list of all sites, use the msgraph-list-sharepoint-sites command.		 Optional
limit The maximum number of results to return. Optional
next_page_url The URL for the next results page.
If a next page of results exists, you will find it in the Cortex XSOAR context under MsGraphFiles.ListDrives.OdataNextLink.		 Optional

Context Output

Path Type Description
MsGraphFiles.ListDrives.Value.LastModifiedDateTime Date Timestamp of when the item was last modified.
MsGraphFiles.ListDrives.Value.Description String A human-readable description of the drive.
MsGraphFiles.ListDrives.Value.CreatedDateTime Date Timestamp of when the drive was created.
MsGraphFiles.ListDrives.Value.WebUrl String URL to the resource in the browser.
MsGraphFiles.ListDrives.Value.CreatedBy String Identity of the user, application, or device that created the drive.
MsGraphFiles.ListDrives.Value.Owner.DisplayName String The display name of the user, device, or application that owns the drive.
MsGraphFiles.ListDrives.Value.Owner.ID String The ID of the user, device, or application that owns the drive.
MsGraphFiles.ListDrives.Value.Owner.Type String The owner type. Can be “user”, “device”, or “application”.
MsGraphFiles.ListDrives.Value.DriveType String The drive type.
MsGraphFiles.ListDrives.Value.ID String The drive ID.
MsGraphFiles.ListDrives.Value.Name String The name of the drive.
MsGraphFiles.ListDrives.OdataContext String The OData query.
MsGraphFiles.ListDrives.NextToken String The token for the next page.

Command Example

!msgraph-list-drives-in-site limit=1 site_id=test limit=1

Context Example
{
    "MsGraphFiles.ListDrives": {
        "OdataContext": "test",
        "Value": [
            {
                "LastModifiedDateTime": "2019-09-21T08:17:20Z",
                "Description": "",
                "CreatedDateTime": "2019-09-21T08:17:20Z",
                "WebUrl": "test",
                "CreatedBy": {
                    "Type": "User",
                    "DisplayName": "System Account"
                },
                "Owner": {
                    "Group": {
                        "DisplayName": "site_test2 Owners",
                        "Email": "test",
                        "ID": "a6975ca6-9adf-40e9-bf1e-3f574e7510ae"
                    }
                },
                "DriveType": "documentLibrary",
                "ID": "test",
                "Name": "Documents"
            }
        ]
    }
}

Human Readable Output

MsGraphFiles - Drives information

Created By Created Date Time Description Drive Type ID Last Modified Date Time Name Web Url
System Account 2019-09-21T08:17:20Z   documentLibrary Test 2019-09-21T08:17:20Z Documents Test

msgraph-list-drive-content

Returns a list of files and folders in the specified drive.

Base Command

msgraph-list-drive-content

Required Permissions

Client Credentials Flow - Files.Read.All - Application
Authorization Code Flow - Files.Read - Delegated

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drive’: To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
For resource type ‘group’: To get a list of all groups that exists, configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: To get a list of all sites, use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: To get a list of all users that exists, configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The MS Graph item ID.
It can be either ‘root’ or another folder.
Passing a folder ID retrieves files from a specified folder.
The default is ‘root’: It retrieves the content in the root of the drive.

To get the required folder ID, use the msgraph-list-drive-content command and leave the argument empty in order to get a list of folders that are located in the root.

If your folder is nested inside another folder, pass the parent ID found when running the msgraph-list-drive-content command without an ‘item_id’ in this argument to get the required folder ID.		 Optional
limit The maximum number of results to return. Optional
next_page_url The URL for the next results page.
If a next page of results exists, you will find it in the Cortex XSOAR context under MsGraphFiles.ListChildren.OdataNextLink.		 Optional

Context Output

Path Type Description
MsGraphFiles.ListChildren.Children.Value.OdataNextLink String The URL for the next results page.
MsGraphFiles.ListChildren.Children.Value.ParentReference.DriveId String Unique identifier of the drive that contains the item.
MsGraphFiles.ListChildren.Children.Value.ParentReference.DriveType String The drive type.
MsGraphFiles.ListChildren.Children.Value.ParentReference.ID String Unique identifier of the item in the drive.
MsGraphFiles.ListChildren.Children.Value.ParentReference.Path String The path to the item.
MsGraphFiles.ListChildren.Children.Value.LastModifiedDateTime Date Timestamp of when the item was last modified.
MsGraphFiles.ListChildren.Children.Value.Name String The file name.
MsGraphFiles.ListChildren.Children.Value.CreatedDateTime Date Timestamp of when the item was created.
MsGraphFiles.ListChildren.Children.Value.WebUrl String URL to the resource in the browser.
MsGraphFiles.ListChildren.Children.Value.FileSystemInfo.CreatedDateTime Date Timestamp of when the item was created on a client.
MsGraphFiles.ListChildren.Children.Value.FileSystemInfo.LastModifiedDateTime Date Timestamp of when the item was last modified on a client.
MsGraphFiles.ListChildren.Children.Value.LastModifiedBy.DisplayName String The item display name.
MsGraphFiles.ListChildren.Children.Value.LastModifiedBy.ID String Identity of the application, user, or device that last modified the item.
MsGraphFiles.ListChildren.Children.Value.CreatedBy.DisplayName String Identity of the user, device, or application that created the item.
MsGraphFiles.ListChildren.Children.Value.CreatedBy.ID String The ID of the creator.
MsGraphFiles.ListChildren.Children.Value.CreatedBy.Type String The created by type. Can be “application”, “user”, or “device”.
MsGraphFiles.ListChildren.ID String The file ID or folder ID.
MsGraphFiles.ListChildren.Children.Size Number The file size or folder size.
MsGraphFiles.ListChildren.Children.OdataContext String The OData query.
MsGraphFiles.ListChildren.NextToken String The token for the next page.

Command Example

!msgraph-list-drive-content object_type=drives limit=1 object_type_id=test parent_id=test

Context Example
{
    "MsGraphFiles.ListChildren": {
        "Children": {
            "OdataContext": "test",
            "Value": [
                {
                    "ParentReference": {
                        "DriveId": "test",
                        "DriveType": "documentLibrary",
                        "ID": "test",
                        "Path": "test"
                    },
                    "LastModifiedDateTime": "2019-12-29T11:57:41Z",
                    "Name": "Attachments",
                    "CreatedDateTime": "2019-12-29T11:57:41Z",
                    "WebUrl": "test",
                    "FileSystemInfo": {
                        "CreatedDateTime": "2019-12-29T11:57:41Z",
                        "LastModifiedDateTime": "2019-12-29T11:57:41Z"
                    },
                    "LastModifiedBy": {
                        "Type": "Application",
                        "DisplayName": "MS Graph Files",
                        "ID": "test"
                    },
                    "CreatedBy": {
                        "Type": "Application",
                        "DisplayName": "MS Graph Files Dev",
                        "ID": "test"
                    },
                    "Folder": {
                        "ChildCount": 2
                    },
                    "ID": "test",
                    "Size": 0
                }
            ]
        },
        "ParentID": "root"
    }
}

Human Readable Output

MsGraphFiles - drivesItems information

Created By Created Date Time Description ID Last Modified Date Time Name Size Web Url
MS Graph Files Dev 2019-12-29T11:57:41Z   123 2019-12-29T11:57:41Z Attachments 0 123

msgraph-list-sharepoint-sites

Returns a list of the tenant sites.

Base Command

msgraph-list-sharepoint-sites

Required Permissions

Client Credentials Flow - Sites.Read.All - Application
Authorization Code Flow - Sites.Read.All - Delegated

Input

Argument Name Description Required
keyword Keyword used to search for sites across a SharePoint tenant. If a keyword is not provided, it returns all sites. Optional

Context Output

Path Type Description
MsGraph.Sites Unknown The MS Graph site object.
MsGraphFiles.OdataContext String The OData query.
MsGraphFiles.OdataNextLink String The URL for the next results page.
MsGraphFiles.ListSites.Value.LastModifiedDateTime String Timestamp of when the item was last modified.
MsGraphFiles.ListSites.Value.DisplayName String The item display name.
MsGraphFiles.ListSites.Value.Description String The item description.
MsGraphFiles.ListSites.Value.CreatedDateTime Date Timestamp of when the site was created.
MsGraphFiles.ListSites.Value.WebUrl String URL to the resource in the browser.
MsGraphFiles.ListSites.Value.OdataContext String The OData query.
MsGraphFiles.ListSites.Value.SiteCollection.Hostname String The hostname for the site collection.
MsGraphFiles.ListSites.Value.ID String The site ID.
MsGraphFiles.ListSites.Value.Name String The site name.

Command Example

!msgraph-list-share-point-sites site_id=123

Context Example
{
    "MsGraphFiles.ListSites": {
        "OdataContext": "123",
        "Value": [
            {
                "LastModifiedDateTime": "2016-09-14T11:13:53Z",
                "DisplayName": "XSOAR Team",
                "Name": "123",
                "CreatedDateTime": "2016-09-14T11:12:59Z",
                "WebUrl": "123",
                "SiteCollection": {
                    "Hostname": "123"
                },
                "Root": {},
                "ID": "123"
            }
        ]
    }
}

Human Readable Output

Created Date Time ID Last Modified Date Time Name Web Url
2016-09-14T11:12:59Z 123 2016-09-14T11:13:53Z 123 123

msgraph-download-file

Downloads the file contents of the drive item.

Base Command

msgraph-download-file

Required Permissions

Client Credentials Flow - Files.Read.All - Application
Authorization Code Flow - Files.Read - Delegated

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drive’: To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
For resource type ‘group’: To get a list of all groups that exists, configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: To get a list of all sites, use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: To get a list of all users that exists, configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The MS Graph item ID.
To get the ID of the file you want to download, use the msgraph-list-drive-content command.		 Required
file_name The file name to download.
Use msgraph-list-drive-content to retrieve the name of a file, if not provided, the file name will be the value of the item_id argument.		 Optional

Context Output

Path Type Description
File.Size String The file size.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.SHA512 String The SHA512 hash of the file.
File.Name String The file name.
File.SSDeep String The SSDeep hash of the file.
File.EntryID Unknown The Cortex XSOAR file ID.
File.Info String Information about the file.
File.Type String The file type.
File.MD5 String The MD5 hash of the file.

Command Example

!msgraph-download-file object_type=drives object_type_id=123 item_id=123

msgraph-list-site-permissions

List of apps with permissions for the site. If permission_id is provided, it will return the details of that permission.

Required Permissions

Sites.FullControl.All
The command only runs from admin instance.

Base Command

msgraph-list-site-permissions

Input

Argument Name Description Required
limit The maximum number of results to return. Default is 50. Optional
site_id The ID of the site. Required if site_name is not provided.
To find a list of all sites, use the msgraph-list-sharepoint-sites command.		 Optional
site_name The name of the site. Required if site_id is not provided. Optional
permission_id The ID of the permission. Optional
all_results Whether to retrieve all the apps with permission for the site. If true, the “limit” argument will be ignored. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
MsGraphFiles.SitePermission.id String The unique identifier of the permission among all permissions on the item.
MsGraphFiles.SitePermission.roles List The type of permission, for example, read.
MsGraphFiles.SitePermission.grantedToIdentitiesV2.application.id String Unique identifier for the application.
MsGraphFiles.SitePermission.grantedToIdentitiesV2.application.displayName String The display name of the application. The display name might not always be available or up to date.

Command example

!msgraph-list-site-permissions site_name=Test

Context Example

{
    "MsGraphFiles": {
        "SitePermission": [
            {
                "grantedToIdentities": [
                    {
                        "application": {
                            "displayName": "MS Graph Files",
                            "id": "test_id"
                        }
                    }
                ],
                "grantedToIdentitiesV2": [
                    {
                        "application": {
                            "displayName": "MS Graph Files",
                            "id": "test_id"
                        }
                    }
                ],
                "id": "test_id"
            },
            {
                "grantedToIdentities": [
                    {
                        "application": {
                            "displayName": "test_admin",
                            "id": "test_id"
                        }
                    }
                ],
                "grantedToIdentitiesV2": [
                    {
                        "application": {
                            "displayName": "test_admin",
                            "id": "test_id"
                        }
                    }
                ],
                "id": "test_id"
            }
        ]
    }
}

Human Readable Output

Site Permission

Application ID Application Name ID
test_id MS Graph Files test_id
test_id test_sk_1_admin test_id

msgraph-create-site-permissions

Create a new application permission for a site.

Required Permissions

Sites.FullControl.All
The command only runs from admin instance.

Base Command

msgraph-create-site-permissions

Input

Argument Name Description Required
site_id The ID of the site. Required if site_name is not provided.
To find a list of all sites, use the msgraph-list-sharepoint-sites command.		 Optional
site_name The name of the site. Required if site_id is not provided. Optional
role read: Provides the ability to read the metadata and contents of the item.
write: Provides the ability to read and modify the metadata and contents of the item.
owner: Site owners can create and manage lists, libraries, and pages within their site, as well as manage user access and permissions. Possible values are: read, write, owner.		 Required
app_id The ID of the application. Required
display_name The display name of the application. Required

Context Output

There is no context output for this command.

Command example

!msgraph-create-site-permissions site_name=Test role=write app_id=test_id display_name=test

Context Example

{
    "MsGraphFiles": {
        "SitePermission": {
            "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#sites(test)/permissions/$entity",
            "grantedToIdentities": [
                {
                    "application": {
                        "displayName": "test",
                        "id": "test_id"
                    }
                }
            ],
            "grantedToIdentitiesV2": [
                {
                    "application": {
                        "displayName": "test",
                        "id": "test_id"
                    }
                }
            ],
            "id": "test_id",
            "roles": [
                "write"
            ]
        }
    }
}

Human Readable Output

Site Permission

Application ID Application Name ID Roles
test test test write

msgraph-update-site-permissions

Updates an existing permission for a site.

Required Permissions

Sites.FullControl.All
The command only runs from admin instance.

Base Command

msgraph-update-site-permissions

Input

Argument Name Description Required
site_name The name of the site. Required if site_id is not provided. Optional
site_id The ID of the site. Required if site_name is not provided.
To find a list of all sites, use the msgraph-list-sharepoint-sites command.		 Optional
permission_id The unique identifier of the permission to update. Required
role read: Provides the ability to read the metadata and contents of the item.
write: Provides the ability to read and modify the metadata and contents of the item.
owner: Site owners can create and manage lists, libraries, and pages within their site, as well as manage user access and permissions. Possible values are: read, write, owner.		 Required

Context Output

There is no context output for this command.

Command example

!msgraph-update-site-permissions permission_id=test role=read site_name=Test

Human Readable Output

Permission test_id of site site_id was updated successfully with new role [‘read’].

msgraph-delete-site-permissions

Deletes an app permission from a site.

Required Permissions

Sites.FullControl.All
The command only runs from admin instance.

Base Command

msgraph-delete-site-permissions

Input

Argument Name Description Required
site_id Unique identifier for SharePoint site. Required if site_name is not provided.
To find a list of all sites, use the msgraph-list-sharepoint-sites command.		 Optional
site_name The name of the site. Required if site_id is not provided. Optional
permission_id The unique identifier of the permission to delete. Required

Context Output

There is no context output for this command.

Command example

!msgraph-delete-site-permissions site_name=Test permission_id=test_id

Human Readable Output

Site permission was deleted.

msgraph-files-auth-test

Tests connectivity to Microsoft.

Base Command

msgraph-files-auth-test

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msgraph-files-generate-login-url

Generate the login URL used for Authorization code flow.

Base Command

msgraph-files-generate-login-url

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msgraph-files-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

msgraph-files-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msgraph-get-sensitivity-label

Retrieves the sensitivity label currently assigned to a drive item. Returns the label ID, display name, and protection state regardless of whether the label has encryption enabled.

Base Command

msgraph-get-sensitivity-label

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drive’: To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
For resource type ‘group’: To get a list of all groups that exist, configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: To get a list of all sites, use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: To get a list of all users that exist, configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The ID of the drive item to read the sensitivity label from. Required

Context Output

Path Type Description
MsGraphFiles.SensitivityLabel.itemId String The ID of the drive item the label was retrieved from.
MsGraphFiles.SensitivityLabel.id String The GUID of the sensitivity label assigned to the drive item, or empty string when no label is assigned.
MsGraphFiles.SensitivityLabel.displayName String The human-readable display name of the assigned sensitivity label, or empty string when no label is assigned.
MsGraphFiles.SensitivityLabel.protectionEnabled Boolean True if the assigned label has encryption/protection settings; false for classification-only labels. Defaults to false when no label is assigned.

Command example

!msgraph-get-sensitivity-label object_type=drives object_type_id=b!example item_id=01EXAMPLE

Human Readable Output

Sensitivity Label

Item Id Display Name Id Protection Enabled
01EXAMPLE Confidential 08973045-2fd6-4014-9177-9f2a3e55c29e false

msgraph-assign-sensitivity-label

Assigns a sensitivity label to a drive item. Microsoft Graph treats this call as a long-running operation and returns the operation status URL in the Location response header; poll that URL to track completion. HTTP error responses from Microsoft Graph are surfaced verbatim as a command error.

Base Command

msgraph-assign-sensitivity-label

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drive’: To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
For resource type ‘group’: To get a list of all groups that exist, configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: To get a list of all sites, use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: To get a list of all users that exist, configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The ID of the drive item to assign the sensitivity label to. Required
sensitivity_label_id The GUID of the sensitivity label to assign. Pass an empty string to remove the existing sensitivity label from the drive item. Retrieve label GUIDs from the Microsoft Purview compliance portal or via the PowerShell Get-Label cmdlet. Required
assignment_method Assignment method recorded on Microsoft Graph.
standard: a user-driven assignment.
privileged: overrides existing user-applied labels.
auto: recorded as a system-driven assignment. Possible values are: standard, privileged, auto.		 Optional
justification_text Free-text justification recorded with the assignment. Required by Microsoft Graph when downgrading or replacing a user-assigned label. Optional

Context Output

Path Type Description
MsGraphFiles.AssignedSensitivityLabel.itemId String The ID of the drive item the label was assigned to.
MsGraphFiles.AssignedSensitivityLabel.sensitivityLabelId String The GUID of the sensitivity label that was assigned. Empty string indicates the existing label was removed.
MsGraphFiles.AssignedSensitivityLabel.location String URL returned in the Microsoft Graph Location response header. Microsoft Graph treats assignSensitivityLabel as a long-running operation; poll this URL to track the operation’s completion status.

Command example

!msgraph-assign-sensitivity-label object_type=drives object_type_id=b!example item_id=01EXAMPLE sensitivity_label_id=08973045-2fd6-4014-9177-9f2a3e55c29e

Human Readable Output

Assigned Sensitivity Label

Item Id Sensitivity Label Id Location
01EXAMPLE 08973045-2fd6-4014-9177-9f2a3e55c29e https://contoso.sharepoint.com/_api/v2.0/monitor/MyMonitorJobId

msgraph-driveitem-update

Updates a driveItem (move within or across drives, rename, or update metadata) by issuing PATCH on the driveItem.
At least one of new_parent_id, new_parent_drive_id, new_name, description, or conflict_behavior must be provided.

Base Command

msgraph-driveitem-update

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drives’: use the msgraph-list-drives-in-site command to retrieve drive IDs.
For resource type ‘groups’: configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The ID of the driveItem to update.
To get the ID, use the msgraph-list-drive-content command.		 Required
new_parent_id New parent folder ID for a move operation. Sets parentReference.id in the request body.
To get a folder ID, use the msgraph-list-drive-content command.		 Optional
new_parent_drive_id New parent drive ID for a cross-drive move. Sets parentReference.driveId in the request body.
Use together with new_parent_id when moving the item to a folder on a different drive.		 Optional
new_name New name for the driveItem (rename). Sets the top-level name field in the request body. Optional
description New description for the driveItem. Sets the description field in the request body. Optional
conflict_behavior Conflict resolution behavior when a destination item with the same name already exists.
Sets the @microsoft.graph.conflictBehavior field in the request body. If omitted, Microsoft Graph’s default applies (fail). Possible values are: fail, replace, rename.		 Optional

Context Output

Path Type Description
MsGraphFiles.UpdatedItem.ID String The unique identifier of the driveItem.
MsGraphFiles.UpdatedItem.Name String The name of the driveItem.
MsGraphFiles.UpdatedItem.WebUrl String URL to the driveItem in the browser.
MsGraphFiles.UpdatedItem.Size Number The size of the driveItem in bytes.
MsGraphFiles.UpdatedItem.LastModifiedDateTime Date Timestamp of when the driveItem was last modified.
MsGraphFiles.UpdatedItem.CreatedDateTime Date Timestamp of when the driveItem was created.
MsGraphFiles.UpdatedItem.ParentReference.DriveId String Unique identifier of the drive that contains the driveItem.
MsGraphFiles.UpdatedItem.ParentReference.DriveType String Identifies the drive type.
MsGraphFiles.UpdatedItem.ParentReference.ID String Unique identifier of the parent folder.
MsGraphFiles.UpdatedItem.ParentReference.Path String The path of the parent folder.
MsGraphFiles.UpdatedItem.LastModifiedBy.DisplayName String Display name of the identity that last modified the driveItem.
MsGraphFiles.UpdatedItem.LastModifiedBy.Type String The identity type that last modified the driveItem (user, application, or device).
MsGraphFiles.UpdatedItem.File.MimeType String The MIME type of the file.
MsGraphFiles.UpdatedItem.OdataContext String The OData context.

msgraph-driveitem-copy

Initiates an asynchronous copy of a driveItem (file or folder) within or across drives. Microsoft Graph processes the copy asynchronously and responds 202 Accepted with a monitor URL. Poll the returned MonitorUrl directly against Microsoft Graph (using the same access token) until the body reports status completed or failed.

Base Command

msgraph-driveitem-copy

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drives’: use the msgraph-list-drives-in-site command to retrieve drive IDs.
For resource type ‘groups’: configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The ID of the source driveItem to copy.
To get the ID, use the msgraph-list-drive-content command.		 Required
destination_parent_id Destination parent folder ID. Sets parentReference.id in the request body.
To get a folder ID, use the msgraph-list-drive-content command.		 Optional
destination_drive_id Destination drive ID. Sets parentReference.driveId in the request body.
Use together with destination_parent_id when copying to a folder on a different drive.		 Optional
new_name New name for the copied driveItem. Sets the name field in the request body. Optional
conflict_behavior Conflict resolution behavior when a destination item with the same name already exists.
Sets the @microsoft.graph.conflictBehavior query parameter. If omitted, Microsoft Graph’s default applies (fail). Possible values are: fail, replace, rename.		 Optional
children_only When true, only the children of the source folder are copied (the folder itself is not created at the destination). Sets the childrenOnly field in the request body. Possible values are: true, false. Optional

Context Output

Path Type Description
MsGraphFiles.CopyOperation.MonitorUrl String URL to poll for the asynchronous copy status. Issue an HTTP GET against this URL using the same Microsoft Graph access token. The response body returns fields including status (`notStarted`, `inProgress`, `completed`, `failed`), percentageComplete, resourceId, and resourceLocation. Terminal states are `completed` and `failed`.
MsGraphFiles.CopyOperation.ItemId String Echo of the source driveItem ID supplied to the command (for context joining).
MsGraphFiles.CopyOperation.ObjectType String Echo of the object_type argument supplied to the command.
MsGraphFiles.CopyOperation.ObjectTypeId String Echo of the object_type_id argument supplied to the command.

msgraph-driveitem-permissions-list

Lists the sharing permissions on a driveItem. Returns both link-style permissions (anyone-with-link, organization-wide-link, scoped link) and direct grants (per-user / per-group / per-application). The InheritedFrom field is non-null when the permission is inherited from a parent folder.

Base Command

msgraph-driveitem-permissions-list

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drives’: use the msgraph-list-drives-in-site command to retrieve drive IDs.
For resource type ‘groups’: configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The ID of the driveItem whose sharing permissions to list.
To get the ID, use the msgraph-list-drive-content command.		 Required
limit The maximum number of permissions to return per page. Sets the $top query parameter. Optional
next_page_url The URL for the next results page (the @odata.nextLink value from a previous response, surfaced under MsGraphFiles.ItemPermission.NextToken). Optional

Context Output

Path Type Description
MsGraphFiles.ItemPermission.Value.ID String The unique identifier of the permission on the driveItem.
MsGraphFiles.ItemPermission.Value.Roles Unknown The roles granted by this permission (for example, read, write, owner).
MsGraphFiles.ItemPermission.Value.Link.Scope String The sharing scope of a link permission. One of anonymous, organization, users.
MsGraphFiles.ItemPermission.Value.Link.Type String The sharing link type. One of view, edit, embed.
MsGraphFiles.ItemPermission.Value.Link.WebUrl String The shareable URL of the sharing link.
MsGraphFiles.ItemPermission.Value.GrantedToV2.User.DisplayName String Display name of the user the permission is granted to.
MsGraphFiles.ItemPermission.Value.GrantedToV2.User.Email String Email of the user the permission is granted to.
MsGraphFiles.ItemPermission.Value.GrantedToV2.User.ID String ID of the user the permission is granted to.
MsGraphFiles.ItemPermission.Value.GrantedToV2.Group.Email String Email of the group the permission is granted to.
MsGraphFiles.ItemPermission.Value.GrantedToV2.SiteUser.LoginName String Login name of the SharePoint site user the permission is granted to.
MsGraphFiles.ItemPermission.Value.GrantedToIdentitiesV2 Unknown List of identities the permission is granted to. Populated when more than one identity holds the permission.
MsGraphFiles.ItemPermission.Value.InheritedFrom.ID String When non-null, indicates the permission is inherited from a parent driveItem. Inherited permissions cannot be deleted directly.
MsGraphFiles.ItemPermission.Value.ExpirationDateTime Date The timestamp when this permission expires.
MsGraphFiles.ItemPermission.Value.HasPassword Boolean When true, the link permission is password protected.
MsGraphFiles.ItemPermission.ItemId String Echo of the item_id argument supplied to the command (for context joining).
MsGraphFiles.ItemPermission.ObjectType String Echo of the object_type argument supplied to the command.
MsGraphFiles.ItemPermission.ObjectTypeId String Echo of the object_type_id argument supplied to the command.
MsGraphFiles.ItemPermission.OdataContext String The OData context.
MsGraphFiles.ItemPermission.NextToken String The @odata.nextLink value. Pass this to next_page_url to fetch the next page.

msgraph-driveitem-permission-delete

Deletes (revokes) a single sharing permission from a driveItem. Returns success when Microsoft Graph responds 204. For bulk-delete loops where intermittent 404s (already removed) are acceptable, enable “Continue on error” on the calling task.

Base Command

msgraph-driveitem-permission-delete

Input

Argument Name Description Required
object_type The MS Graph resource. Possible values are: drives, groups, sites, users. Required
object_type_id MS Graph resource ID.
For resource type ‘drives’: use the msgraph-list-drives-in-site command to retrieve drive IDs.
For resource type ‘groups’: configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Required
item_id The ID of the driveItem whose permission to delete.
To get the ID, use the msgraph-list-drive-content command.		 Required
permission_id The ID of the permission to delete.
To get the permission ID, use the msgraph-driveitem-permissions-list command.
Note: Inherited permissions (where InheritedFrom is non-null in the listing) cannot be deleted directly; strip the permission on the parent driveItem instead.		 Required

Context Output

Path Type Description
MsGraphFiles.RemovedItemPermission.ItemId String Echo of the item_id argument supplied to the command.
MsGraphFiles.RemovedItemPermission.PermissionId String Echo of the permission_id argument that was deleted.
MsGraphFiles.RemovedItemPermission.ObjectType String Echo of the object_type argument supplied to the command.
MsGraphFiles.RemovedItemPermission.ObjectTypeId String Echo of the object_type_id argument supplied to the command.

msgraph-driveitem-analytics-get

Retrieves activity statistics for a file or folder (driveItem), such as how many times it was viewed and by how many people.
Analytics are stored against the SharePoint list representation of the item, so the command first resolves the item’s SharePoint list identifiers and then reads the analytics from the list item. This resolution is internal - only site_id and item_id are needed.
Note: Analytics data is not available in all national deployments and is not supported for personal Microsoft accounts. When no analytics data has been collected for the item, Microsoft Graph returns an empty result rather than an error.

Required Permissions

Client Credentials Flow - Sites.Read.All - Application or Sites.ReadWrite.All - Application
Authorization Code Flow - Sites.Read.All - Delegated or Sites.ReadWrite.All - Delegated

Base Command

msgraph-driveitem-analytics-get

Input

Argument Name Description Required
site_id The ID of the SharePoint site containing the item.
To get the ID, use the msgraph-list-sharepoint-sites command.		 Required
item_id The ID of the driveItem whose analytics to retrieve.
To get the ID, use the msgraph-list-drive-content or msgraph-driveitem-metadata-get command.
Note: This endpoint does not support addressing the item by path.		 Required
time_range The time range the statistics cover. Possible values are: allTime, lastSevenDays. Default is allTime. Optional

Context Output

Path Type Description
MsGraphFiles.ItemAnalytics.ItemId String Echo of the item_id argument supplied to the command (for context joining).
MsGraphFiles.ItemAnalytics.SiteID String Echo of the site_id argument supplied to the command.
MsGraphFiles.ItemAnalytics.TimeRange String The time range the returned statistics cover.
MsGraphFiles.ItemAnalytics.Stats.StartDateTime Date The start of the time range the statistics cover.
MsGraphFiles.ItemAnalytics.Stats.EndDateTime Date The end of the time range the statistics cover.
MsGraphFiles.ItemAnalytics.Stats.Access.ActionCount Number The number of times the item was accessed.
MsGraphFiles.ItemAnalytics.Stats.Access.ActorCount Number The number of distinct users who accessed the item.
MsGraphFiles.ItemAnalytics.Stats.Edit.ActionCount Number The number of times the item was edited.
MsGraphFiles.ItemAnalytics.Stats.Edit.ActorCount Number The number of distinct users who edited the item.
MsGraphFiles.ItemAnalytics.Stats.Create.ActionCount Number The number of times the item was created. Present only when Microsoft Graph returns this facet.
MsGraphFiles.ItemAnalytics.Stats.Create.ActorCount Number The number of distinct users who created the item. Present only when Microsoft Graph returns this facet.
MsGraphFiles.ItemAnalytics.Stats.Delete.ActionCount Number The number of times the item was deleted. Present only when Microsoft Graph returns this facet.
MsGraphFiles.ItemAnalytics.Stats.Delete.ActorCount Number The number of distinct users who deleted the item. Present only when Microsoft Graph returns this facet.

msgraph-driveitem-metadata-get

Retrieves the metadata of a file or folder (driveItem). The item can be addressed by ID, by path relative to the drive root, or by a sharing URL. Exactly one of item_id, item_path, or share_url must be provided.
The returned ItemID is scoped to the drive that stores the item, which is returned as DriveId. A sharing URL that points to a personal file resolves against that user’s OneDrive, so the ItemID it returns differs from the ID the same file has under a SharePoint site library.
Note: addressing the item by share_url requires the Files.ReadWrite.All application permission (or Files.ReadWrite delegated), which is higher than the Files.Read.All required by the item_id and item_path options, even though this command only reads data.

Required Permissions

Client Credentials Flow - Files.Read.All - Application or Files.ReadWrite.All - Application (Note: addressing the item by share_url requires Files.ReadWrite.All - Application)
Authorization Code Flow - Files.Read.All - Delegated or Files.ReadWrite.All - Delegated (Note: addressing the item by share_url requires Files.ReadWrite - Delegated)

Base Command

msgraph-driveitem-metadata-get

Input

Argument Name Description Required
object_type The MS Graph resource. Required together with object_type_id, unless share_url is used. Possible values are: drives, groups, sites, users. Default is sites. Optional
object_type_id MS Graph resource ID. Required together with object_type, unless share_url is used.
For resource type ‘drives’: use the msgraph-list-drives-in-site command to retrieve drive IDs.
For resource type ‘groups’: configure the ‘Entra ID Groups’ integration and use the msgraph-groups-list-groups command.
For resource type ‘sites’: use the msgraph-list-sharepoint-sites command.
For resource type ‘users’: configure the ‘Entra ID Users’ integration and use the msgraph-user-list command.		 Optional
item_id The ID of the driveItem whose metadata to retrieve.
Provide exactly one of item_id, item_path, or share_url.
To get the ID, use the msgraph-list-drive-content command.		 Optional
item_path The path of the file or folder relative to the drive root, for example “Documents/report.docx”.
Provide exactly one of item_id, item_path, or share_url.		 Optional
share_url A sharing URL pointing to the file, for example a “copy link” URL.
Provide exactly one of item_id, item_path, or share_url.
Note: This option requires the Files.ReadWrite.All application permission (or Files.ReadWrite delegated), which is higher than the Files.Read.All required by the item_id and item_path options, even though this command only reads data.		 Optional
include_sharepoint_ids Whether to include the sharepointIds property, which contains the listItemUniqueId and listId values used to correlate the file with SharePoint list items. Microsoft Graph does not return this property as part of the driveItem, so when enabled the command issues an additional request and merges the result into a single output. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
MsGraphFiles.Files.ID String The unique identifier of the driveItem.
MsGraphFiles.Files.ItemID String The unique identifier of the driveItem. Duplicated from ID for convenience when correlating with other commands.
MsGraphFiles.Files.SiteID String The ID of the SharePoint site containing the item, lifted from the parent reference.
MsGraphFiles.Files.Name String The name of the file or folder.
MsGraphFiles.Files.Size Number The size of the file in bytes.
MsGraphFiles.Files.WebUrl String The URL that displays the item in the browser.
MsGraphFiles.Files.CreatedDateTime Date The date and time the item was created.
MsGraphFiles.Files.LastModifiedDateTime Date The date and time the item was last modified.
MsGraphFiles.Files.CreatedBy.User.DisplayName String The display name of the user who created the item.
MsGraphFiles.Files.CreatedBy.User.Email String The email of the user who created the item.
MsGraphFiles.Files.CreatedBy.User.ID String The ID of the user who created the item.
MsGraphFiles.Files.LastModifiedBy.User.DisplayName String The display name of the user who last modified the item.
MsGraphFiles.Files.LastModifiedBy.User.Email String The email of the user who last modified the item.
MsGraphFiles.Files.LastModifiedBy.User.ID String The ID of the user who last modified the item.
MsGraphFiles.Files.ParentReference.ID String The ID of the parent folder.
MsGraphFiles.Files.ParentReference.SiteId String The ID of the site containing the parent folder.
MsGraphFiles.Files.DriveId String The ID of the drive that stores the item, lifted from the parent reference. ItemID is only meaningful within this drive.
MsGraphFiles.Files.SharepointIds.ListItemUniqueId String The unique identifier of the item within the SharePoint list. Used to correlate the driveItem with SharePoint list items.
MsGraphFiles.Files.SharepointIds.ListId String The identifier of the SharePoint list containing the item.
MsGraphFiles.Files.SharepointIds.SiteId String The SharePoint site identifier.

msgraph-driveitem-activities-list

Retrieves the recent activities that took place on a file or folder (driveItem), such as who accessed it and when.
Activities are stored against the SharePoint list representation of the item, so the command first resolves the item’s SharePoint list identifiers and then reads the activities from the list item. This resolution is internal - only site_id and item_id are needed.
Note: Activity data is not available in all national deployments and is not supported for personal Microsoft accounts. When no activity has been recorded for the item, Microsoft Graph returns an empty result rather than an error.

Required Permissions

Client Credentials Flow - Sites.Read.All - Application or Sites.ReadWrite.All - Application
Authorization Code Flow - Sites.Read.All - Delegated or Sites.ReadWrite.All - Delegated

Base Command

msgraph-driveitem-activities-list

Input

Argument Name Description Required
site_id The ID of the SharePoint site containing the item.
To get the ID, use the msgraph-list-sharepoint-sites command.		 Required
item_id The ID of the driveItem whose activities to retrieve.
To get the ID, use the msgraph-list-drive-content or msgraph-driveitem-metadata-get command.
Note: This endpoint does not support addressing the item by path.		 Required
limit The maximum number of activities to return. This endpoint does not support server-side paging parameters, so the limit is applied after the results are retrieved. Optional
next_page_url The URL for the next results page (the @odata.nextLink value from a previous response, surfaced under MsGraphFiles.ItemActivity.NextToken). Optional

Context Output

Path Type Description
MsGraphFiles.ItemActivity.Value.ID String The unique identifier of the activity.
MsGraphFiles.ItemActivity.Value.Times.RecordedDateTime Date The date and time the activity was recorded.
MsGraphFiles.ItemActivity.Value.Action Unknown The action facets of the activity, for example Access, Edit, Share, Rename, Move, Delete, Restore, Comment or Version. Each facet is present only when the activity included that action.
MsGraphFiles.ItemActivity.Value.Action.Version.NewVersion String The resulting version number, when the activity created a new version.
MsGraphFiles.ItemActivity.Value.Actor.User.DisplayName String The display name of the user who performed the activity.
MsGraphFiles.ItemActivity.Value.Actor.User.Email String The email of the user who performed the activity.
MsGraphFiles.ItemActivity.Value.Actor.User.ID String The ID of the user who performed the activity.
MsGraphFiles.ItemActivity.Value.DriveItem.ID String The ID of the driveItem the activity relates to.
MsGraphFiles.ItemActivity.ItemId String Echo of the item_id argument supplied to the command (for context joining).
MsGraphFiles.ItemActivity.SiteID String Echo of the site_id argument supplied to the command.
MsGraphFiles.ItemActivity.OdataContext String The OData context.
MsGraphFiles.ItemActivity.NextToken String The @odata.nextLink value. Pass this to next_page_url to fetch the next page.

Configuration parameters

  • host — Server URL (required)
  • auth_id — Application ID / Client ID
  • credentials_auth_id —
  • tenant_id — Token / Tenant ID
  • credentials_tenant_id —
  • enc_key — Key / Client Secret
  • credentials_enc_key —
  • redirect_uri — Application redirect URI (for Self Deployed - Authorization Code Flow)
  • auth_code_creds —
  • certificate_thumbprint — Certificate Thumbprint
  • credentials_certificate_thumbprint —
  • private_key — Private Key
  • self_deployed — Use a self-deployed Azure Application
  • use_managed_identities — Use Azure Managed Identities
  • managed_identities_client_id —
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (24)

  • msgraph-assign-sensitivity-label

    Assigns a sensitivity label to a drive item. Microsoft Graph treats this call as a long-running operation and returns the operation status URL in the Location response header; poll that URL to track completion. HTTP error responses from Microsoft Graph are surfaced verbatim as a command error.

  • msgraph-create-new-folder

    Creates a new folder in a drive with the specified parent item or path.

  • msgraph-create-site-permissions

    Create a new application permission for a site.

  • msgraph-delete-file

    Deletes an item from OneDrive.

  • msgraph-delete-site-permissions

    Deletes an app permission from a site.

  • msgraph-download-file

    Downloads the file contents of the drive item.

  • msgraph-driveitem-activities-list

    Retrieves the recent activities that took place on a file or folder (driveItem), such as who accessed it and when. Activities are stored against the SharePoint list representation of the item, so the command first resolves the item's SharePoint list identifiers and then reads the activities from the list item. This resolution is internal - only site_id and item_id are needed. Note: Activity data is not available in all national deployments and is not supported for personal Microsoft accounts. When no activity has been recorded for the item, Microsoft Graph returns an empty result rather than an error.

  • msgraph-driveitem-analytics-get

    Retrieves activity statistics for a file or folder (driveItem), such as how many times it was viewed and by how many people. Analytics are stored against the SharePoint list representation of the item, so the command first resolves the item's SharePoint list identifiers and then reads the analytics from the list item. This resolution is internal - only site_id and item_id are needed. Note: Analytics data is not available in all national deployments and is not supported for personal Microsoft accounts. When no analytics data has been collected for the item, Microsoft Graph returns an empty result rather than an error.

  • msgraph-driveitem-copy

    Initiates an asynchronous copy of a driveItem (file or folder) within or across drives. Microsoft Graph processes the copy asynchronously and responds 202 Accepted with a monitor URL. Poll the returned MonitorUrl directly against Microsoft Graph (using the same access token) until the body reports status `completed` or `failed`.

  • msgraph-driveitem-metadata-get

    Retrieves the metadata of a file or folder (driveItem). The item can be addressed by ID, by path relative to the drive root, or by a sharing URL. Exactly one of item_id, item_path, or share_url must be provided. The returned ItemID is scoped to the drive that stores the item, which is returned as DriveId. A sharing URL that points to a personal file resolves against that user's OneDrive, so the ItemID it returns differs from the ID the same file has under a SharePoint site library. Note: addressing the item by share_url requires the Files.ReadWrite.All application permission (or Files.ReadWrite delegated), which is higher than the Files.Read.All required by the item_id and item_path options, even though this command only reads data.

  • msgraph-driveitem-permission-delete

    Deletes (revokes) a single sharing permission from a driveItem. Returns success when Microsoft Graph responds 204. For bulk-delete loops where intermittent 404s (already removed) are acceptable, enable "Continue on error" on the calling task.

  • msgraph-driveitem-permissions-list

    Lists the sharing permissions on a driveItem. Returns both link-style permissions (anyone-with-link, organization-wide-link, scoped link) and direct grants (per-user / per-group / per-application). The InheritedFrom field is non-null when the permission is inherited from a parent folder.

  • msgraph-driveitem-update

    Updates a driveItem (move within or across drives, rename, or update metadata) by issuing PATCH on the driveItem. At least one of new_parent_id, new_parent_drive_id, new_name, description, or conflict_behavior must be provided.

  • msgraph-files-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • msgraph-files-auth-test

    Tests connectivity to Microsoft.

  • msgraph-files-generate-login-url

    Generate the login URL used for Authorization code flow.

  • msgraph-get-sensitivity-label

    Retrieves the sensitivity label currently assigned to a drive item. Returns the label ID, display name, and protection state regardless of whether the label has encryption enabled.

  • msgraph-list-drive-content

    Returns a list of files and folders in the specified drive.

  • msgraph-list-drives-in-site

    Returns the list of document libraries (drives) available for a target site.

  • msgraph-list-sharepoint-sites

    Returns a list of the tenant sites. This command requires the 'Sites.Read.All' permission.

  • msgraph-list-site-permissions

    List of apps with permissions for the site. if permission_id is provided, it will return the details of that permission.

  • msgraph-replace-existing-file

    Replaces the content of the file in the specified MS Graph resource.

  • msgraph-update-site-permissions

    Updates an existing permission for a site.

  • msgraph-upload-new-file

    Uploads a file from Cortex XSOAR to the specified MS Graph resource.

Source

MicrosoftGraphFilesStandardConnector.py MicrosoftGraphFilesStandardConnector_test.py MicrosoftGraphFilesStandardConnector.yml MicrosoftGraphFilesStandardConnector_description.md
Download History Raw 
category: Email
provider: Microsoft
sectionorder:
- Connect
commonfields:
  id: MicrosoftGraphFilesStandardConnector
  version: -1
configuration:
- defaultvalue: https://graph.microsoft.com
  display: Server URL
  name: host
  required: true
  type: 0
  section: Connect
- display: Application ID / Client ID
  name: auth_id
  type: 4
  hidden: true
  required: false
  section: Connect
- name: credentials_auth_id
  type: 9
  displaypassword: Application ID / Client ID
  hiddenusername: true
  required: false
  section: Connect
- display: Token / Tenant ID
  name: tenant_id
  type: 4
  hidden: true
  required: false
  section: Connect
- name: credentials_tenant_id
  type: 9
  displaypassword: Token / Tenant ID
  hiddenusername: true
  required: false
  section: Connect
- display: Key / Client Secret
  name: enc_key
  type: 4
  hidden: true
  required: false
  section: Connect
- name: credentials_enc_key
  type: 9
  displaypassword: Key / Client Secret
  hiddenusername: true
  required: false
  section: Connect
- display: Application redirect URI (for Self Deployed - Authorization Code Flow)
  name: redirect_uri
  type: 0
  section: Connect
  required: false
- display: ''
  name: auth_code_creds
  type: 9
  displaypassword: Authorization code (for Self Deployed - Authorization Code Flow)
  hiddenusername: true
  section: Connect
  required: false
- additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  display: Certificate Thumbprint
  name: certificate_thumbprint
  type: 4
  hidden: true
  required: false
  section: Connect
- name: credentials_certificate_thumbprint
  type: 9
  additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  displaypassword: Certificate Thumbprint
  hiddenusername: true
  required: false
  section: Connect
- additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  display: Private Key
  name: private_key
  type: 14
  required: false
  section: Connect
- additionalinfo: Select this checkbox if you are using a self-deployed Azure application.
  display: Use a self-deployed Azure Application
  name: self_deployed
  type: 8
  required: false
  section: Connect
- additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.
  display: Use Azure Managed Identities
  name: use_managed_identities
  type: 8
  required: false
  section: Connect
- additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: 'This integration is configured automatically as part of the O365 File Management (Onedrive/Sharepoint/Teams) Standard Connector. Do not configure this integration directly — set it up from the connector page instead.'
display: O365 File Management (Onedrive/Sharepoint/Teams) (Standard Connector)
name: MicrosoftGraphFilesStandardConnector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      isArray: true
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drive': To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
        For resource type 'group': To get a list of all groups that exists, configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': To get a list of all sites, use the msgraph-list-sharepoint-sites command.
        For resource type 'users': To get a list of all users that exists, configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The ID of the item to delete.
        To get the ID of the file you want to delete, use the msgraph-list-drive-content command.
      name: item_id
      required: true
    description: Deletes an item from OneDrive.
    name: msgraph-delete-file
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - users
      - sites
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drive': To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
        For resource type 'group': To get a list of all groups that exists, configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': To get a list of all sites, use the msgraph-list-sharepoint-sites command.
        For resource type 'users': To get a list of all users that exists, configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The ID of the folder in which to upload the file.
        To get the ID of a folder, use the msgraph-list-drive-content command.
      name: parent_id
      required: true
    - description: The name of the file to upload.
      name: file_name
      required: true
    - description: The Cortex XSOAR entry ID of the file.
      name: entry_id
      required: true
    description: Uploads a file from Cortex XSOAR to the specified MS Graph resource.
    name: msgraph-upload-new-file
    outputs:
    - contextPath: MsGraphFiles.UploadedFiles.ParentReference.DriveId
      description: Unique identifier of the drive that contains the item.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.ParentReference.DriveType
      description: Identifies the drive type.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.ParentReference.ID
      description: Unique identifier of the item in the drive.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.ParentReference.Path
      description: The path of the item.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.LastModifiedDateTime
      description: The timestamp of when the item was last modified.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.File.MimeType
      description: The file type.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.File.Hashes
      description: The file hash type.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.CreatedDateTime
      description: The timestamp of when the item was created.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.WebUrl
      description: The URL of the resource in the browser.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.OdataContext
      description: The OData query.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.FileSystemInfo.CreatedDateTime
      description: The timestamp of when the item was created on a client.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.FileSystemInfo.LastModifiedDateTime
      description: The timestamp of when the item was last modified on a client.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.LastModifiedBy.DisplayName
      description: The item display name.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.LastModifiedBy.Type
      description: The application, user, or device that last modified the item.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.CreatedBy.DisplayName
      description: The identity of the user, device, or application that created the item.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.CreatedBy.ID
      description: The ID of the creator.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.CreatedBy.Type
      description: The application, user, or device that created the item.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.DownloadUrl
      description: The URL to download this file's content.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.Size
      description: The file size.
      type: Number
    - contextPath: MsGraphFiles.UploadedFiles.ID
      description: The file ID.
      type: String
    - contextPath: MsGraphFiles.UploadedFiles.Name
      description: The file name.
      type: String
    - contextPath: MsGraph.UploadedFiles.File
      description: The MS Graph file object.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drive': To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
        For resource type 'group': To get a list of all groups that exists, configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': To get a list of all sites, use the msgraph-list-sharepoint-sites command.
        For resource type 'users': To get a list of all users that exists, configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The MS Graph item ID of the file you want to replace.
        To get the ID of the file you want to replace, use the msgraph-list-drive-content command.
      name: item_id
      required: true
    - description: The Cortex XSOAR entry ID of the new file that will replace the current file.
      name: entry_id
      required: true
    description: Replaces the content of the file in the specified MS Graph resource.
    name: msgraph-replace-existing-file
    outputs:
    - contextPath: MsGraphFiles.ReplacedFiles.ParentReference.DriveId
      description: Unique identifier of the drive that contains the item.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.ParentReference.DriveType
      description: The drive type.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.ParentReference.ID
      description: Unique identifier of the item in the drive.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.ParentReference.Path
      description: The path of the item.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.LastModifiedDateTime
      description: Timestamp of when the item was last modified.
      type: Date
    - contextPath: MsGraphFiles.ReplacedFiles.File.MimeType
      description: The file type.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.File.Hashes
      description: The file hash type.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.CreatedDateTime
      description: Timestamp of when the item was created.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.WebUrl
      description: URL to the resource in the browser.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.OdataContext
      description: The OData query.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.FileSystemInfo.CreatedDateTime
      description: Timestamp of when the item was created on a client.
      type: Date
    - contextPath: MsGraphFiles.ReplacedFiles.FileSystemInfo.LastModifiedDateTime
      description: Timestamp of when the item was last modified on a client.
      type: Date
    - contextPath: MsGraphFiles.ReplacedFiles.LastModifiedBy.DisplayName
      description: The item display name.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.LastModifiedBy.ID
      description: Identity of the application that last modified the item.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.CreatedBy.DisplayName
      description: Identity of the user, device, or application that created the item.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.CreatedBy.ID
      description: The ID of the creator.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.CreatedBy.Type
      description: Application, user, or device.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.DownloadUrl
      description: URL to download the file's content.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.Size
      description: File's size.
      type: Number
    - contextPath: MsGraphFiles.ReplacedFiles.Id
      description: The file ID.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.Name
      description: The file name.
      type: String
    - contextPath: MsGraphFiles.ReplacedFiles.File
      description: The MS Graph file object.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drive': To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
        For resource type 'group': To get a list of all groups that exists, configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': To get a list of all sites, use the msgraph-list-sharepoint-sites command.
        For resource type 'users': To get a list of all users that exists, configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The ID of the parent in which to upload the new folder.
        Parent can be either 'root' or another folder.
        To get the required folder ID, use the msgraph-list-drive-content command.
      name: parent_id
      required: true
    - description: The name of the new folder.
      name: folder_name
      required: true
    description: Creates a new folder in a drive with the specified parent item or path.
    name: msgraph-create-new-folder
    outputs:
    - contextPath: MsGraph.Folder
      description: The MS Graph folder object.
      type: Unknown
    - contextPath: Msgraphfiles.CreatedFolder.ParentReference.DriveId
      description: Unique identifier of the drive that contains the item.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.ParentReference.DriveType
      description: The drive type.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.ParentReference.ID
      description: Unique identifier of the item in the drive.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.ParentReference.Path
      description: The path to the item.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.LastModifiedDateTime
      description: Timestamp of when the item was last modified.
      type: Date
    - contextPath: Msgraphfiles.CreatedFolder.Name
      description: The folder name.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.CreatedDateTime
      description: Timestamp of when the item was created.
      type: Date
    - contextPath: Msgraphfiles.CreatedFolder.WebUrl
      description: URL to the resource in the browser.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.OdataContext
      description: The OData query.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.FileSystemInfo.CreatedDateTime
      description: Timestamp of when the item was created on a client.
      type: Date
    - contextPath: Msgraphfiles.CreatedFolder.FileSystemInfo.LastModifiedDateTime
      description: Timestamp of when the item was last modified on a client.
      type: Date
    - contextPath: Msgraphfiles.CreatedFolder.LastModifiedBy.DisplayName
      description: The item display name.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.LastModifiedBy.ID
      description: Identity of the application that last modified the item.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.CreatedBy.DisplayName
      description: Identity of the user, device,or application that created the item.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.CreatedBy.ID
      description: The ID of the creator.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.ChildCount
      description: The number of sub-items in the folder.
      type: Number
    - contextPath: Msgraphfiles.CreatedFolder.ID
      description: The folder ID.
      type: String
    - contextPath: Msgraphfiles.CreatedFolder.Size
      description: The folder size.
      type: Number
  - arguments:
    - description: |-
        The ID of the site for which to return available drive resources.
        To find a list of all sites, use the msgraph-list-sharepoint-sites command.
      name: site_id
    - description: The maximum number of results to return.
      name: limit
    - description: |-
        The URL for the next results page.
        If a next page of results exists, you will find it in the Cortex XSOAR context under MsGraphFiles.ListDrives.OdataNextLink.
      name: next_page_url
    description: Returns the list of document libraries (drives) available for a target site.
    name: msgraph-list-drives-in-site
    outputs:
    - contextPath: MsGraphFiles.ListDrives.Value.LastModifiedDateTime
      description: Timestamp of when the item was last modified.
      type: Date
    - contextPath: MsGraphFiles.ListDrives.Value.Description
      description: A human-readable description of the drive.
      type: String
    - contextPath: MsGraphFiles.ListDrives.Value.CreatedDateTime
      description: Timestamp of when the drive was created.
      type: Date
    - contextPath: MsGraphFiles.ListDrives.Value.WebUrl
      description: URL to the resource in the browser.
      type: String
    - contextPath: MsGraphFiles.ListDrives.Value.CreatedBy
      description: Identity of the user, application, or device that created the drive.
      type: String
    - contextPath: MsGraphFiles.ListDrives.Value.Owner.DisplayName
      description: The display name of the user, device, or application that owns the drive.
      type: String
    - contextPath: MsGraphFiles.ListDrives.Value.Owner.ID
      description: The ID of the user, device, or application that owns the drive.
      type: String
    - contextPath: MsGraphFiles.ListDrives.Value.Owner.Type
      description: The owner type. Can be "user", "device", or "application".
      type: String
    - contextPath: MsGraphFiles.ListDrives.Value.DriveType
      description: The drive type.
      type: String
    - contextPath: MsGraphFiles.ListDrives.Value.ID
      description: The drive ID.
      type: String
    - contextPath: MsGraphFiles.ListDrives.Value.Name
      description: The name of the drive.
      type: String
    - contextPath: MsGraphFiles.ListDrives.OdataContext
      description: The OData query.
      type: String
    - contextPath: MsGraphFiles.ListDrives.NextToken
      description: The token for the next page.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drive': To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
        For resource type 'group': To get a list of all groups that exists, configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': To get a list of all sites, use the msgraph-list-sharepoint-sites command.
        For resource type 'users': To get a list of all users that exists, configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The MS Graph item ID.
        It can be either 'root' or another folder.
        Passing a folder ID retrieves files from a specified folder.
        The default is 'root': It retrieves the content in the root of the drive.

        To get the required folder ID, use the msgraph-list-drive-content command and leave the argument empty in order to get a list of folders that are located in the root.

        If your folder is nested inside another folder, pass the parent ID found when running the msgraph-list-drive-content command without an 'item_id' in this argument to get the required folder ID.
      name: item_id
    - description: The maximum number of results to return.
      name: limit
    - description: |-
        The URL for the next results page.
        If a next page of results exists, you will find it in the Cortex XSOAR context under MsGraphFiles.ListChildren.OdataNextLink
      name: next_page_url
    description: Returns a list of files and folders in the specified drive.
    name: msgraph-list-drive-content
    outputs:
    - contextPath: MsGraphFiles.ListChildren.Children.Value.OdataNextLink
      description: The URL for the next results page.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.ParentReference.DriveId
      description: Unique identifier of the drive that contains the item.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.ParentReference.DriveType
      description: The drive type.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.ParentReference.ID
      description: Unique identifier of the item in the drive.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.ParentReference.Path
      description: The path to the item.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.LastModifiedDateTime
      description: Timestamp of when the item was last modified.
      type: Date
    - contextPath: MsGraphFiles.ListChildren.Children.Value.Name
      description: The file name.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.CreatedDateTime
      description: Timestamp of when the item was created.
      type: Date
    - contextPath: MsGraphFiles.ListChildren.Children.Value.WebUrl
      description: URL to the resource in the browser.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.FileSystemInfo.CreatedDateTime
      description: Timestamp of when the item was created on a client.
      type: Date
    - contextPath: MsGraphFiles.ListChildren.Children.Value.FileSystemInfo.LastModifiedDateTime
      description: Timestamp of when the item was last modified on a client.
      type: Date
    - contextPath: MsGraphFiles.ListChildren.Children.Value.LastModifiedBy.DisplayName
      description: The item display name.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.LastModifiedBy.ID
      description: Identity of the application, user, or device that last modified the item.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.CreatedBy.DisplayName
      description: Identity of the user, device, or application that created the item.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.CreatedBy.ID
      description: The ID of the creator.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Value.CreatedBy.Type
      description: The created by type. Can be "application", "user", or "device".
      type: String
    - contextPath: MsGraphFiles.ListChildren.ID
      description: The file ID or folder ID.
      type: String
    - contextPath: MsGraphFiles.ListChildren.Children.Size
      description: The file size or folder size.
      type: Number
    - contextPath: MsGraphFiles.ListChildren.Children.OdataContext
      description: The OData query.
      type: String
    - contextPath: MsGraphFiles.ListChildren.NextToken
      description: The token for the next page.
      type: String
  - arguments:
    - description: Keyword used to search for sites across a SharePoint tenant. If a keyword is not provided, it returns all sites.
      name: keyword
    description: "Returns a list of the tenant sites. This command requires the 'Sites.Read.All' permission."
    name: msgraph-list-sharepoint-sites
    outputs:
    - contextPath: MsGraph.Sites
      description: The MS Graph site object.
      type: Unknown
    - contextPath: MsGraphFiles.OdataContext
      description: The OData query.
      type: String
    - contextPath: MsGraphFiles.OdataNextLink
      description: The URL for the next results page.
      type: String
    - contextPath: MsGraphFiles.ListSites.Value.LastModifiedDateTime
      description: Timestamp of when the item was last modified.
      type: String
    - contextPath: MsGraphFiles.ListSites.Value.DisplayName
      description: The item display name.
      type: String
    - contextPath: MsGraphFiles.ListSites.Value.Description
      description: The item description.
      type: String
    - contextPath: MsGraphFiles.ListSites.Value.CreatedDateTime
      description: Timestamp of when the site was created.
      type: Date
    - contextPath: MsGraphFiles.ListSites.Value.WebUrl
      description: URL to the resource in the browser.
      type: String
    - contextPath: MsGraphFiles.ListSites.Value.OdataContext
      description: The OData query.
      type: String
    - contextPath: MsGraphFiles.ListSites.Value.SiteCollection.Hostname
      description: The hostname for the site collection.
      type: String
    - contextPath: MsGraphFiles.ListSites.Value.ID
      description: The site ID.
      type: String
    - contextPath: MsGraphFiles.ListSites.Value.Name
      description: The site name.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drive': To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
        For resource type 'group': To get a list of all groups that exists, configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': To get a list of all sites, use the msgraph-list-sharepoint-sites command.
        For resource type 'users': To get a list of all users that exists, configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The MS Graph item ID.
        To get the ID of the file you want to download, use the msgraph-list-drive-content command.
      name: item_id
      required: true
    - name: file_name
      description: |-
        The file name to download.
        Use msgraph-list-drive-content to retrieve the name of a file,
        if not provided, the file name will be the value of the item_id argument.
      required: false
    description: Downloads the file contents of the drive item.
    name: msgraph-download-file
    outputs:
    - contextPath: File.Size
      description: The file size.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Name
      description: The file name.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The Cortex XSOAR file ID.
      type: Unknown
    - contextPath: File.Info
      description: Information about the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
  - description: Run this command if for some reason you need to rerun the authentication process.
    execution: false
    name: msgraph-files-auth-reset
    arguments: []
  - arguments:
    - description: The maximum number of results to return.
      name: limit
      defaultValue: 50
    - description: |-
        The ID of the site. Required if site_name is not provided.
        To find a list of all sites, use the msgraph-list-sharepoint-sites command.
      name: site_id
    - description: The name of the site. Required if site_id is not provided.
      name: site_name
    - description: The ID of the permission.
      name: permission_id
    - auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to retrieve all the apps with permission for the site. If true, the "limit" argument will be ignored.
      name: all_results
      defaultValue: "false"
    name: msgraph-list-site-permissions
    description: List of apps with permissions for the site. if permission_id is provided, it will return the details of that permission.
    outputs:
    - contextPath: MsGraphFiles.SitePermission.id
      description: The unique identifier of the permission among all permissions on the item.
      type: String
    - contextPath: MsGraphFiles.SitePermission.roles
      description: The type of permission, for example, read.
      type: List
    - contextPath: MsGraphFiles.SitePermission.grantedToIdentitiesV2.application.id
      description: Unique identifier for the application.
      type: String
    - contextPath: MsGraphFiles.SitePermission.grantedToIdentitiesV2.application.displayName
      description: The display name of the application. The display name might not always be available or up to date.
      type: String
  - arguments:
    - description: |-
        The ID of the site. Required if site_name is not provided.
        To find a list of all sites, use the msgraph-list-sharepoint-sites command.
      name: site_id
    - description: The name of the site. Required if site_id is not provided.
      name: site_name
    - auto: PREDEFINED
      predefined:
      - read
      - write
      - owner
      description: |-
        read: Provides the ability to read the metadata and contents of the item.
        write: Provides the ability to read and modify the metadata and contents of the item.
        owner: Site owners can create and manage lists, libraries, and pages within their site, as well as manage user access and permissions.
      name: role
      required: true
    - description: The ID of the application.
      name: app_id
      required: true
    - description: The display name of the application.
      name: display_name
      required: true
    name: msgraph-create-site-permissions
    description: Create a new application permission for a site.
  - arguments:
    - description: The name of the site. Required if site_id is not provided.
      name: site_name
    - description: |-
        The ID of the site. Required if site_name is not provided.
        To find a list of all sites, use the msgraph-list-sharepoint-sites command.
      name: site_id
    - description: The unique identifier of the permission to update.
      name: permission_id
      required: true
    - auto: PREDEFINED
      predefined:
      - read
      - write
      - owner
      description: |-
        read: Provides the ability to read the metadata and contents of the item.
        write: Provides the ability to read and modify the metadata and contents of the item.
        owner: Site owners can create and manage lists, libraries, and pages within their site, as well as manage user access and permissions.
      name: role
      required: true
    name: msgraph-update-site-permissions
    description: Updates an existing permission for a site.
  - arguments:
    - description: |-
        Unique identifier for SharePoint site. Required if site_name is not provided.
        To find a list of all sites, use the msgraph-list-sharepoint-sites command.
      name: site_id
    - description: The name of the site. Required if site_id is not provided.
      name: site_name
    - description: The unique identifier of the permission to delete.
      name: permission_id
      required: true
    name: msgraph-delete-site-permissions
    description: Deletes an app permission from a site.
  - description: |-
      Updates a driveItem (move within or across drives, rename, or update metadata) by issuing PATCH on the driveItem.
      At least one of new_parent_id, new_parent_drive_id, new_name, description, or conflict_behavior must be provided.
    name: msgraph-driveitem-update
    arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drives': use the msgraph-list-drives-in-site command to retrieve drive IDs.
        For resource type 'groups': configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': use the msgraph-list-sharepoint-sites command.
        For resource type 'users': configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The ID of the driveItem to update.
        To get the ID, use the msgraph-list-drive-content command.
      name: item_id
      required: true
    - description: |-
        New parent folder ID for a move operation. Sets parentReference.id in the request body.
        To get a folder ID, use the msgraph-list-drive-content command.
      name: new_parent_id
    - description: |-
        New parent drive ID for a cross-drive move. Sets parentReference.driveId in the request body.
        Use together with new_parent_id when moving the item to a folder on a different drive.
      name: new_parent_drive_id
    - description: New name for the driveItem (rename). Sets the top-level name field in the request body.
      name: new_name
    - description: New description for the driveItem. Sets the description field in the request body.
      name: description
    - auto: PREDEFINED
      description: |-
        Conflict resolution behavior when a destination item with the same name already exists.
        Sets the @microsoft.graph.conflictBehavior field in the request body. If omitted, Microsoft Graph's default applies (fail).
      name: conflict_behavior
      predefined:
      - fail
      - replace
      - rename
    outputs:
    - contextPath: MsGraphFiles.UpdatedItem.ID
      description: The unique identifier of the driveItem.
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.Name
      description: The name of the driveItem.
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.WebUrl
      description: URL to the driveItem in the browser.
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.Size
      description: The size of the driveItem in bytes.
      type: Number
    - contextPath: MsGraphFiles.UpdatedItem.LastModifiedDateTime
      description: Timestamp of when the driveItem was last modified.
      type: Date
    - contextPath: MsGraphFiles.UpdatedItem.CreatedDateTime
      description: Timestamp of when the driveItem was created.
      type: Date
    - contextPath: MsGraphFiles.UpdatedItem.ParentReference.DriveId
      description: Unique identifier of the drive that contains the driveItem.
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.ParentReference.DriveType
      description: Identifies the drive type.
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.ParentReference.ID
      description: Unique identifier of the parent folder.
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.ParentReference.Path
      description: The path of the parent folder.
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.LastModifiedBy.DisplayName
      description: Display name of the identity that last modified the driveItem.
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.LastModifiedBy.Type
      description: The identity type that last modified the driveItem (user, application, or device).
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.File.MimeType
      description: The MIME type of the file.
      type: String
    - contextPath: MsGraphFiles.UpdatedItem.OdataContext
      description: The OData context.
      type: String
  - description: |-
      Initiates an asynchronous copy of a driveItem (file or folder) within or across drives. Microsoft Graph processes the copy asynchronously and responds 202 Accepted with a monitor URL. Poll the returned MonitorUrl directly against Microsoft Graph (using the same access token) until the body reports status `completed` or `failed`.
    name: msgraph-driveitem-copy
    arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drives': use the msgraph-list-drives-in-site command to retrieve drive IDs.
        For resource type 'groups': configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': use the msgraph-list-sharepoint-sites command.
        For resource type 'users': configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The ID of the source driveItem to copy.
        To get the ID, use the msgraph-list-drive-content command.
      name: item_id
      required: true
    - description: |-
        Destination parent folder ID. Sets parentReference.id in the request body.
        To get a folder ID, use the msgraph-list-drive-content command.
      name: destination_parent_id
    - description: |-
        Destination drive ID. Sets parentReference.driveId in the request body.
        Use together with destination_parent_id when copying to a folder on a different drive.
      name: destination_drive_id
    - description: New name for the copied driveItem. Sets the name field in the request body.
      name: new_name
    - auto: PREDEFINED
      description: |-
        Conflict resolution behavior when a destination item with the same name already exists.
        Sets the @microsoft.graph.conflictBehavior query parameter. If omitted, Microsoft Graph's default applies (fail).
      name: conflict_behavior
      predefined:
      - fail
      - replace
      - rename
    - description: When true, only the children of the source folder are copied (the folder itself is not created at the destination). Sets the childrenOnly field in the request body.
      name: children_only
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: MsGraphFiles.CopyOperation.MonitorUrl
      description: |-
        URL to poll for the asynchronous copy status. Issue an HTTP GET against this URL using the same Microsoft Graph access token. The response body returns fields including status (`notStarted`, `inProgress`, `completed`, `failed`), percentageComplete, resourceId, and resourceLocation. Terminal states are `completed` and `failed`.
      type: String
    - contextPath: MsGraphFiles.CopyOperation.ItemId
      description: Echo of the source driveItem ID supplied to the command (for context joining).
      type: String
    - contextPath: MsGraphFiles.CopyOperation.ObjectType
      description: Echo of the object_type argument supplied to the command.
      type: String
    - contextPath: MsGraphFiles.CopyOperation.ObjectTypeId
      description: Echo of the object_type_id argument supplied to the command.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drives': use the msgraph-list-drives-in-site command to retrieve drive IDs.
        For resource type 'groups': configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': use the msgraph-list-sharepoint-sites command.
        For resource type 'users': configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The ID of the driveItem whose sharing permissions to list.
        To get the ID, use the msgraph-list-drive-content command.
      name: item_id
      required: true
    - description: The maximum number of permissions to return per page. Sets the $top query parameter.
      name: limit
    - description: |-
        The URL for the next results page (the @odata.nextLink value from a previous response, surfaced under MsGraphFiles.ItemPermission.NextToken).
      name: next_page_url
    description: |-
      Lists the sharing permissions on a driveItem. Returns both link-style permissions (anyone-with-link, organization-wide-link, scoped link) and direct grants (per-user / per-group / per-application). The InheritedFrom field is non-null when the permission is inherited from a parent folder.
    name: msgraph-driveitem-permissions-list
    outputs:
    - contextPath: MsGraphFiles.ItemPermission.Value.ID
      description: The unique identifier of the permission on the driveItem.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.Roles
      description: The roles granted by this permission (for example, read, write, owner).
      type: Unknown
    - contextPath: MsGraphFiles.ItemPermission.Value.Link.Scope
      description: The sharing scope of a link permission. One of anonymous, organization, users.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.Link.Type
      description: The sharing link type. One of view, edit, embed.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.Link.WebUrl
      description: The shareable URL of the sharing link.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.GrantedToV2.User.DisplayName
      description: Display name of the user the permission is granted to.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.GrantedToV2.User.Email
      description: Email of the user the permission is granted to.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.GrantedToV2.User.ID
      description: ID of the user the permission is granted to.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.GrantedToV2.Group.Email
      description: Email of the group the permission is granted to.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.GrantedToV2.SiteUser.LoginName
      description: Login name of the SharePoint site user the permission is granted to.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.GrantedToIdentitiesV2
      description: List of identities the permission is granted to. Populated when more than one identity holds the permission.
      type: Unknown
    - contextPath: MsGraphFiles.ItemPermission.Value.InheritedFrom.ID
      description: When non-null, indicates the permission is inherited from a parent driveItem. Inherited permissions cannot be deleted directly.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.Value.ExpirationDateTime
      description: The timestamp when this permission expires.
      type: Date
    - contextPath: MsGraphFiles.ItemPermission.Value.HasPassword
      description: When true, the link permission is password protected.
      type: Boolean
    - contextPath: MsGraphFiles.ItemPermission.ItemId
      description: Echo of the item_id argument supplied to the command (for context joining).
      type: String
    - contextPath: MsGraphFiles.ItemPermission.ObjectType
      description: Echo of the object_type argument supplied to the command.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.ObjectTypeId
      description: Echo of the object_type_id argument supplied to the command.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.OdataContext
      description: The OData context.
      type: String
    - contextPath: MsGraphFiles.ItemPermission.NextToken
      description: The @odata.nextLink value. Pass this to next_page_url to fetch the next page.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drives': use the msgraph-list-drives-in-site command to retrieve drive IDs.
        For resource type 'groups': configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': use the msgraph-list-sharepoint-sites command.
        For resource type 'users': configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: |-
        The ID of the driveItem whose permission to delete.
        To get the ID, use the msgraph-list-drive-content command.
      name: item_id
      required: true
    - description: |-
        The ID of the permission to delete.
        To get the permission ID, use the msgraph-driveitem-permissions-list command.
        Note: Inherited permissions (where InheritedFrom is non-null in the listing) cannot be deleted directly; strip the permission on the parent driveItem instead.
      name: permission_id
      required: true
    description: |-
      Deletes (revokes) a single sharing permission from a driveItem. Returns success when Microsoft Graph responds 204. For bulk-delete loops where intermittent 404s (already removed) are acceptable, enable "Continue on error" on the calling task.
    name: msgraph-driveitem-permission-delete
    outputs:
    - contextPath: MsGraphFiles.RemovedItemPermission.ItemId
      description: Echo of the item_id argument supplied to the command.
      type: String
    - contextPath: MsGraphFiles.RemovedItemPermission.PermissionId
      description: Echo of the permission_id argument that was deleted.
      type: String
    - contextPath: MsGraphFiles.RemovedItemPermission.ObjectType
      description: Echo of the object_type argument supplied to the command.
      type: String
    - contextPath: MsGraphFiles.RemovedItemPermission.ObjectTypeId
      description: Echo of the object_type_id argument supplied to the command.
      type: String
  - description: |-
      Retrieves the metadata of a file or folder (driveItem). The item can be addressed by ID, by path relative to the drive root, or by a sharing URL. Exactly one of item_id, item_path, or share_url must be provided.
      The returned ItemID is scoped to the drive that stores the item, which is returned as DriveId. A sharing URL that points to a personal file resolves against that user's OneDrive, so the ItemID it returns differs from the ID the same file has under a SharePoint site library.
      Note: addressing the item by share_url requires the Files.ReadWrite.All application permission (or Files.ReadWrite delegated), which is higher than the Files.Read.All required by the item_id and item_path options, even though this command only reads data.
    name: msgraph-driveitem-metadata-get
    arguments:
    - auto: PREDEFINED
      description: The MS Graph resource. Required together with `object_type_id`, unless `share_url` is used.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
    - description: |-
        MS Graph resource ID. Required together with `object_type`, unless `share_url` is used.
        For resource type 'drives': use the **msgraph-list-drives-in-site** command to retrieve drive IDs.
        For resource type 'groups': configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': use the **msgraph-list-sharepoint-sites** command.
        For resource type 'users': configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
    - description: |-
        The ID of the driveItem whose metadata to retrieve.
        Provide exactly one of `item_id`, `item_path`, or `share_url`.
        To get the ID, use the **msgraph-list-drive-content** command.
      name: item_id
    - description: |-
        The path of the file or folder relative to the drive root, for example "Documents/report.docx".
        Provide exactly one of `item_id`, `item_path`, or `share_url`.
      name: item_path
    - description: |-
        A sharing URL pointing to the file, for example a "copy link" URL.
        Provide exactly one of `item_id`, `item_path`, or `share_url`.
        Note: This option requires the Files.ReadWrite.All application permission (or Files.ReadWrite delegated), which is higher than the Files.Read.All required by the item_id and item_path options, even though this command only reads data.
      name: share_url
    - auto: PREDEFINED
      description: Whether to include the sharepointIds property, which contains the listItemUniqueId and listId values used to correlate the file with SharePoint list items. Microsoft Graph does not return this property as part of the driveItem, so when enabled the command issues an additional request and merges the result into a single output.
      name: include_sharepoint_ids
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    outputs:
    - contextPath: MsGraphFiles.Files.ID
      description: The unique identifier of the driveItem.
      type: String
    - contextPath: MsGraphFiles.Files.ItemID
      description: The unique identifier of the driveItem. Duplicated from ID for convenience when correlating with other commands.
      type: String
    - contextPath: MsGraphFiles.Files.SiteID
      description: The ID of the SharePoint site containing the item, lifted from the parent reference.
      type: String
    - contextPath: MsGraphFiles.Files.DriveId
      description: The ID of the drive that stores the item, lifted from the parent reference. ItemID is only meaningful within this drive.
      type: String
    - contextPath: MsGraphFiles.Files.Name
      description: The name of the file or folder.
      type: String
    - contextPath: MsGraphFiles.Files.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: MsGraphFiles.Files.WebUrl
      description: The URL that displays the item in the browser.
      type: String
    - contextPath: MsGraphFiles.Files.CreatedDateTime
      description: The date and time the item was created.
      type: Date
    - contextPath: MsGraphFiles.Files.LastModifiedDateTime
      description: The date and time the item was last modified.
      type: Date
    - contextPath: MsGraphFiles.Files.CreatedBy.User.DisplayName
      description: The display name of the user who created the item.
      type: String
    - contextPath: MsGraphFiles.Files.CreatedBy.User.Email
      description: The email of the user who created the item.
      type: String
    - contextPath: MsGraphFiles.Files.CreatedBy.User.ID
      description: The ID of the user who created the item.
      type: String
    - contextPath: MsGraphFiles.Files.LastModifiedBy.User.DisplayName
      description: The display name of the user who last modified the item.
      type: String
    - contextPath: MsGraphFiles.Files.LastModifiedBy.User.Email
      description: The email of the user who last modified the item.
      type: String
    - contextPath: MsGraphFiles.Files.LastModifiedBy.User.ID
      description: The ID of the user who last modified the item.
      type: String
    - contextPath: MsGraphFiles.Files.ParentReference.ID
      description: The ID of the parent folder.
      type: String
    - contextPath: MsGraphFiles.Files.ParentReference.SiteId
      description: The ID of the site containing the parent folder.
      type: String
    - contextPath: MsGraphFiles.Files.SharepointIds.ListItemUniqueId
      description: The unique identifier of the item within the SharePoint list. Used to correlate the driveItem with SharePoint list items.
      type: String
    - contextPath: MsGraphFiles.Files.SharepointIds.ListId
      description: The identifier of the SharePoint list containing the item.
      type: String
    - contextPath: MsGraphFiles.Files.SharepointIds.SiteId
      description: The SharePoint site identifier.
      type: String
  - description: |-
      Retrieves the recent activities that took place on a file or folder (driveItem), such as who accessed it and when.
      Activities are stored against the SharePoint list representation of the item, so the command first resolves the item's SharePoint list identifiers and then reads the activities from the list item. This resolution is internal - only site_id and item_id are needed.
      Note: Activity data is not available in all national deployments and is not supported for personal Microsoft accounts. When no activity has been recorded for the item, Microsoft Graph returns an empty result rather than an error.
    name: msgraph-driveitem-activities-list
    arguments:
    - description: |-
        The ID of the SharePoint site containing the item.
        To get the ID, use the **msgraph-list-sharepoint-sites** command.
      name: site_id
      required: true
    - description: |-
        The ID of the driveItem whose activities to retrieve.
        To get the ID, use the **msgraph-list-drive-content** or **msgraph-driveitem-metadata-get** command.
        Note: This endpoint does not support addressing the item by path.
      name: item_id
      required: true
    - description: The maximum number of activities to return. This endpoint does not support server-side paging parameters, so the limit is applied after the results are retrieved.
      name: limit
    - description: The URL for the next results page (the @odata.nextLink value from a previous response, surfaced under MsGraphFiles.ItemActivity.NextToken).
      name: next_page_url
    outputs:
    - contextPath: MsGraphFiles.ItemActivity.Value.ID
      description: The unique identifier of the activity.
      type: String
    - contextPath: MsGraphFiles.ItemActivity.Value.Times.RecordedDateTime
      description: The date and time the activity was recorded.
      type: Date
    - contextPath: MsGraphFiles.ItemActivity.Value.Action
      description: The action components of the activity, for example Access, Edit, Share, Rename, Move, Delete, Restore, Comment or Version. Each facet is present only when the activity included that action.
      type: Unknown
    - contextPath: MsGraphFiles.ItemActivity.Value.Action.Version.NewVersion
      description: The resulting version number, when the activity created a new version.
      type: String
    - contextPath: MsGraphFiles.ItemActivity.Value.Actor.User.DisplayName
      description: The display name of the user who performed the activity.
      type: String
    - contextPath: MsGraphFiles.ItemActivity.Value.Actor.User.Email
      description: The email of the user who performed the activity.
      type: String
    - contextPath: MsGraphFiles.ItemActivity.Value.Actor.User.ID
      description: The ID of the user who performed the activity.
      type: String
    - contextPath: MsGraphFiles.ItemActivity.Value.DriveItem.ID
      description: The ID of the driveItem the activity relates to.
      type: String
    - contextPath: MsGraphFiles.ItemActivity.ItemId
      description: Echo of the item_id argument supplied to the command (for context joining).
      type: String
    - contextPath: MsGraphFiles.ItemActivity.SiteID
      description: Echo of the site_id argument supplied to the command.
      type: String
    - contextPath: MsGraphFiles.ItemActivity.OdataContext
      description: The OData context.
      type: String
    - contextPath: MsGraphFiles.ItemActivity.NextToken
      description: The @odata.nextLink value. Pass this to next_page_url to fetch the next page.
      type: String
  - arguments:
    - description: |-
        The ID of the SharePoint site containing the item.
        To get the ID, use the **msgraph-list-sharepoint-sites** command.
      name: site_id
      required: true
    - description: |-
        The ID of the driveItem whose analytics to retrieve.
        To get the ID, use the **msgraph-list-drive-content** or **msgraph-driveitem-metadata-get** command.
        Note: This endpoint does not support addressing the item by path.
      name: item_id
      required: true
    - description: The time range the statistics cover.
      name: time_range
      auto: PREDEFINED
      predefined:
      - allTime
      - lastSevenDays
      defaultValue: allTime
    description: |-
      Retrieves activity statistics for a file or folder (driveItem), such as how many times it was viewed and by how many people.
      Analytics are stored against the SharePoint list representation of the item, so the command first resolves the item's SharePoint list identifiers and then reads the analytics from the list item. This resolution is internal - only site_id and item_id are needed.
      Note: Analytics data is not available in all national deployments and is not supported for personal Microsoft accounts. When no analytics data has been collected for the item, Microsoft Graph returns an empty result rather than an error.
    name: msgraph-driveitem-analytics-get
    outputs:
    - contextPath: MsGraphFiles.ItemAnalytics.ItemId
      description: Echo of the item_id argument supplied to the command (for context joining).
      type: String
    - contextPath: MsGraphFiles.ItemAnalytics.SiteID
      description: Echo of the site_id argument supplied to the command.
      type: String
    - contextPath: MsGraphFiles.ItemAnalytics.TimeRange
      description: The time range the returned statistics cover.
      type: String
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.StartDateTime
      description: The start of the time range the statistics cover.
      type: Date
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.EndDateTime
      description: The end of the time range the statistics cover.
      type: Date
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.Access.ActionCount
      description: The number of times the item was accessed.
      type: Number
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.Access.ActorCount
      description: The number of distinct users who accessed the item.
      type: Number
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.Edit.ActionCount
      description: The number of times the item was edited.
      type: Number
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.Edit.ActorCount
      description: The number of distinct users who edited the item.
      type: Number
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.Create.ActionCount
      description: The number of times the item was created. Present only when Microsoft Graph returns this facet.
      type: Number
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.Create.ActorCount
      description: The number of distinct users who created the item. Present only when Microsoft Graph returns this facet.
      type: Number
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.Delete.ActionCount
      description: The number of times the item was deleted. Present only when Microsoft Graph returns this facet.
      type: Number
    - contextPath: MsGraphFiles.ItemAnalytics.Stats.Delete.ActorCount
      description: The number of distinct users who deleted the item. Present only when Microsoft Graph returns this facet.
      type: Number
  - description: Tests connectivity to Microsoft.
    execution: false
    name: msgraph-files-auth-test
    arguments: []
  - description: Generate the login URL used for Authorization code flow.
    name: msgraph-files-generate-login-url
    arguments: []
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drive': To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
        For resource type 'group': To get a list of all groups that exist, configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': To get a list of all sites, use the msgraph-list-sharepoint-sites command.
        For resource type 'users': To get a list of all users that exist, configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: The ID of the drive item to read the sensitivity label from.
      name: item_id
      required: true
    description: Retrieves the sensitivity label currently assigned to a drive item. Returns the label ID, display name, and protection state regardless of whether the label has encryption enabled.
    name: msgraph-get-sensitivity-label
    outputs:
    - contextPath: MsGraphFiles.SensitivityLabel.itemId
      description: The ID of the drive item the label was retrieved from.
      type: String
    - contextPath: MsGraphFiles.SensitivityLabel.id
      description: The GUID of the sensitivity label assigned to the drive item, or empty string when no label is assigned.
      type: String
    - contextPath: MsGraphFiles.SensitivityLabel.displayName
      description: The human-readable display name of the assigned sensitivity label, or empty string when no label is assigned.
      type: String
    - contextPath: MsGraphFiles.SensitivityLabel.protectionEnabled
      description: True if the assigned label has encryption/protection settings; false for classification-only labels. Defaults to false when no label is assigned.
      type: Boolean
  - arguments:
    - auto: PREDEFINED
      description: The MS Graph resource.
      name: object_type
      predefined:
      - drives
      - groups
      - sites
      - users
      required: true
    - description: |-
        MS Graph resource ID.
        For resource type 'drive': To get a list of all drives in your site, use the msgraph-list-drives-in-site command.
        For resource type 'group': To get a list of all groups that exist, configure the 'Entra ID Groups' integration and use the msgraph-groups-list-groups command.
        For resource type 'sites': To get a list of all sites, use the msgraph-list-sharepoint-sites command.
        For resource type 'users': To get a list of all users that exist, configure the 'Entra ID Users' integration and use the msgraph-user-list command.
      name: object_type_id
      required: true
    - description: The ID of the drive item to assign the sensitivity label to.
      name: item_id
      required: true
    - description: The GUID of the sensitivity label to assign. Pass an empty string to remove the existing sensitivity label from the drive item. Retrieve label GUIDs from the Microsoft Purview compliance portal or via the PowerShell `Get-Label` cmdlet.
      name: sensitivity_label_id
      required: true
    - auto: PREDEFINED
      description: |-
        Assignment method recorded on Microsoft Graph.
        standard: a user-driven assignment.
        privileged: overrides existing user-applied labels.
        auto: recorded as a system-driven assignment.
      name: assignment_method
      predefined:
      - standard
      - privileged
      - auto
    - description: Free-text justification recorded with the assignment. Required by Microsoft Graph when downgrading or replacing a user-assigned label.
      name: justification_text
    description: Assigns a sensitivity label to a drive item. Microsoft Graph treats this call as a long-running operation and returns the operation status URL in the Location response header; poll that URL to track completion. HTTP error responses from Microsoft Graph are surfaced verbatim as a command error.
    name: msgraph-assign-sensitivity-label
    outputs:
    - contextPath: MsGraphFiles.AssignedSensitivityLabel.itemId
      description: The ID of the drive item the label was assigned to.
      type: String
    - contextPath: MsGraphFiles.AssignedSensitivityLabel.sensitivityLabelId
      description: The GUID of the sensitivity label that was assigned. Empty string indicates the existing label was removed.
      type: String
    - contextPath: MsGraphFiles.AssignedSensitivityLabel.location
      description: URL returned in the Microsoft Graph Location response header. Microsoft Graph treats assignSensitivityLabel as a long-running operation; poll this URL to track the operation's completion status.
      type: String
  dockerimage: demisto/crypto:1.0.0.10120494
  script: ''
  subtype: python3
  type: python
fromversion: 8.15.0
tests:
- No tests