Microsoft Graph

Unified gateway to security insights - all from a unified Microsoft Graph Security API.

Analytics & SIEM · Microsoft Graph Security

Details

IDMicrosoft Graph
ProviderMicrosoft
CategoryAnalytics & SIEM
From Version5.0.0
Docker Imagedemisto/crypto:1.0.0.10120494
Supported ModulesAgentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

⚠️ Microsoft Graph Security Legacy Alerts Deprecation

Note: Microsoft has deprecated the Legacy Alerts API. As of April 10, 2026, the Legacy Alerts endpoint no longer returns data. This integration now exclusively uses the Alerts v2 API. For more details, see the Microsoft documentation.

Unified gateway to security insights - all from a unified Microsoft Graph Security API.
This integration was integrated and tested with version 1.0 of Microsoft Graph.

Authentication

For more details about the authentication used in this integration, see Microsoft Integrations - Authentication
Note: The eDiscovery and Threat Assessment commands are only supported when using the Authorization Code flow with Delegated (work or school account) permission type.

When using the Authorization Code flow for this integration, you should log in as an administrator or a user with administrative privileges (Security Reader or Security Administrator) after running the msg-generate-login-url command and the login window appears. For more information, see here.

Fetch Incidents and Alerts

Use the Fetch incidents type parameter to control what this integration ingests. You can select Alerts, Incidents, or both:

  • Alerts - Each Microsoft Graph Security alert is fetched on its own.
  • Incidents - Each Microsoft Graph Security incident is fetched on its own, with all of its associated alerts embedded within it (retrieved via $expand=alerts) and stored as raw JSON. This gives you one grouped incident that already contains its underlying alerts, instead of many separate alert incidents.

You can narrow what is fetched using the Alerts Filter and Incidents Filter parameters. These accept an OData $filter expression, for example severity eq 'medium' and status eq 'active'. For the supported syntax and operators, see Microsoft query parameters.

Important Notes

  • Due to API limitations, the msg-search-alerts command does not filter Office 365 provider alerts.\
    For more information, see: https://github.com/microsoftgraph/security-api-solutions/issues/56.
  • The following properties are supported as filters:
    • Alerts Filter parameter (and alert filter arguments): assignedTo, classification, determination, createdDateTime, lastUpdateDateTime, severity, serviceSource and status. See Microsoft optional alert query parameters.
    • Incidents Filter parameter: assignedTo, classification, createdDateTime, determination, lastUpdateDateTime, severity, and status. See Microsoft optional incident query parameters.
    • The filter should be provided as an OData $filter expression, for example severity eq 'medium' and status eq 'active'. For the general syntax and operators, see Microsoft query parameters.
  • The header include-unknown-enum-members is used when fetching alerts. It ensures that fields with unknown values are correctly mapped to the appropriate service. Learn More.
  • When using Threat Assessment, only the following properties are supported as filters for the filter parameter: expectedAssessment, ContentType, status and requestSource.
  • When using Threat Assessment for information protection, the following limits apply to any request:
    • For email, the resource is a unique network message ID/recipient pair. For example, submitting an email with the same message ID sent to the same person multiple times in a 15 minutes period will trigger the limit per resource limits listed in the following table. However, you can submit up to 150 unique emails every 15 minutes (tenant limit).
    Operation Limit per tenant Limit per resource (email, URL, file)
    POST 150 requests per 15 minutes and 10000 requests per 24 hours. 1 request per 15 minutes and 3 requests per 24 hours.

Required Permissions

  1. User.Read.All - Application (Only required if using the deprecated commands: msg-get-user and msg-get-users)
  2. SecurityIncident.Read.All - Delegated or Application (required for the command msg-list-security-incident and Fetch Incidents)
  3. SecurityIncident.ReadWrite.All - Delegated or Application (required for the command msg-update-security-incident and Fetch Incidents)
  4. ThreatHunting.Read.All - Delegated or Application (required for the command msg-advanced-hunting)

Alerts:

  1. SecurityAlert.Read.All - Application (required for the commands: msg-search-alerts and msg-get-alert-details)
  2. SecurityAlert.ReadWrite.All - Application (required for updating alerts with the commands: msg-update-alert and msg-create-alert-comment)

eDiscovery:

  1. eDiscovery.Read.All - Delegated (Required for the list-ediscovery commands)
  2. eDiscovery.ReadWrite.All - Delegated (Required for the create/update/delete-ediscovery, msg-export-result-ediscovery-data commands)
  3. eDiscovery.Download.Read - Delegated (Required for the msg-list-case-operation, download_file=True command)
    More information about defining this permission can be found here.

Threat Assessment:

  1. Mail.Read.Shared - Delegated
  2. ThreatAssessment.ReadWrite.All - Delegated
  3. User.Read.All - Delegated

Configure Microsoft Graph Security on Cortex

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Microsoft Graph Security.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    Azure Cloud When selecting the Custom option, the Host URL parameter must be filled. More information about National clouds can be found here. False
    Host URL The host URL. When using this parameter, select the Custom option for the Azure Cloud. More information about National clouds can be found here. False
    Application ID or Client ID The app registration ID. True
    Token or Tenant ID The tenant ID. True
    Key or Client Secret The app registration secret. False
    Authorization code Get the authorization code from steps 3-5 in the self deployed authorization process. False
    Application redirect URI (for self-deployed mode) The app registration redirect URI. False
    Certificate Thumbprint Used for certificate authentication, as it appears in the “Certificates & secrets” page of the app. False
    Private Key Used for certificate authentication. The private key of the registered certificate. False
    Use Azure Managed Identities Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. False
    Azure Managed Identities Client ID The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. False
    Trust any certificate (not secure) Whether to trust any certificate. If True, not secure. False
    Use system proxy settings Whether to use system proxy settings. False
    Use a self-deployed Azure application Whether to use a self-deployed application. False
    Fetch incidents Whether to fetch incidents. False
    Incident type The incident type to apply. False
    First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) <number> <time unit>, for example 1 hour, 30 minutes. False
    Fetch limit per type The maximum number of items to fetch per type. Applies to both alerts and incidents. Note that when fetching incidents, no more than 50 can be fetched per cycle, due to a Microsoft limitation. False
    Fetch incidents type Select which record types to fetch. You can select Alerts, Incidents, or both. False
    Alerts Service Sources Relevant only when fetching Alerts (incidents have no service source). Multiple serviceSource values can be provided, separated by commas, for example “microsoftDefenderForEndpoint,microsoftCloudAppSecurity”. If empty, alerts of all service sources will be fetched. False
    Alerts Filter Use this field to filter fetched alerts according to their properties. Applies only when fetching Alerts. Overrides the service sources list, if given. Filter should be in the format “{property} eq ‘{property-value}’”. Multiple filters can be applied separated with “ and “, for example “createdDateTime eq YYYY-MM-DD and severity eq ‘high’”. False
    Incidents Filter Use this field to filter fetched incidents according to their properties. Applies only when fetching Incidents. Filter should be in the format “{property} eq ‘{property-value}’”. Multiple filters can be applied separated with “ and “, for example “severity eq ‘high’ and status eq ‘active’”. False
    Microsoft 365 Defender context When selected, the hunting query result is also saved to the Microsoft 365 Defender context path. Relevant only for the msg-advanced-hunting command. False
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msg-auth-test

Tests connectivity to Microsoft Graph Security.

Base Command

msg-auth-test

Input

Argument Name Description Required
permission_type Which permissions the integration should have. Possible values are: ediscovery, alerts, alerts, ediscovery. Default is ediscovery. Optional

Context Output

There is no context output for this command.

Command example

!msg-auth-test permission_type=ediscovery

Human Readable Output

Authentication was successful.

msg-search-alerts

List alerts (security issues) within a customer’s tenant that Microsoft or partner security solutions have identified.

Base Command

msg-search-alerts

Input

Argument Name Description Required
last_modified When the alert was last modified in the following string format - YYYY-MM-DD. Possible values are: Last24Hours, Last48Hours, LastWeek. Optional
severity Alert severity - set by vendor/provider. Possible values are: unknown, informational, low, medium, high. Optional
category Category of the alert, e.g., credentialTheft, ransomware (Categories can be added or removed by vendors.). Optional
time_from The start time (creation time of alert) for the search in the following string format - YYYY-MM-DD. Optional
time_to The end time (creation time of alert) for the search in the following string format - YYYY-MM-DD. Optional
filter Use this field to filter on any of the alert properties in the format “{property} eq ‘{property-value}’”, e.g. “category eq ‘ransomware’”. Optional
classification Use this field to filter by alert’s classification. Possible values are: unknown, truePositive, falsePositive, benignPositive. Optional
service_source Use this field to filter the alerts by the service or product that created this alert. Possible values are: microsoftDefenderForEndpoint, microsoftDefenderForIdentity, microsoftDefenderForOffice365, microsoft365Defender, microsoftAppGovernance, microsoftDefenderForCloudApps. Optional
status Use this field to filter by alert’s status. Possible values are: unknown, new, inProgress, resolved. Optional
page Page number to return, zero indexed. Optional
page_size Number of results in a page. Default is 50. The limit is 2000. Optional
limit Number of total results to return. Default is 50. Optional

Context Output

Path Type Description
MsGraph.Alert.ID string Alert ID.
MsGraph.Alert.Title string Alert title.
MsGraph.Alert.Category string Alert category.
MsGraph.Alert.Severity string Alert severity.
MsGraph.Alert.CreatedDate date Alert created date.
MsGraph.Alert.Status string Alert status.
MsGraph.Alert.ActorDisplayName Unknown Alert actor name.
MsGraph.Alert.AlertWebUrl String Alert web URL.
MsGraph.Alert.AssignedTo Unknown Alert assignee.
MsGraph.Alert.Classification Unknown Alert classification.
MsGraph.Alert.Description String Alert description.
MsGraph.Alert.DetectionSource String Alert detection source.
MsGraph.Alert.DetectorId String Alert detector ID.
MsGraph.Alert.Determination Unknown Alert determination.
MsGraph.Alert.Evidence.@odata.Type String Alert evidence.
MsGraph.Alert.Evidence.AzureAdDeviceId String Evidence Azure device ID.
MsGraph.Alert.Evidence.CreatedDate Date Evidence creation time.
MsGraph.Alert.Evidence.DefenderAvStatus String Evidence Defender AV status.
MsGraph.Alert.Evidence.DeviceDnsName String Evidence device DNS name.
MsGraph.Alert.Evidence.FirstSeenDateTime Date Evidence first seen time.
MsGraph.Alert.Evidence.HealthStatus String Evidence health status.
MsGraph.Alert.Evidence.MdeDeviceId String Evidence MDE device ID.
MsGraph.Alert.Evidence.OnboardingStatus String Evidence onboarding status.
MsGraph.Alert.Evidence.OsBuild Number Evidence OS build.
MsGraph.Alert.Evidence.OsPlatform String Evidence OS platform.
MsGraph.Alert.Evidence.RbacGroupId Number Evidence RBAC group ID.
MsGraph.Alert.Evidence.RbacGroupName String Evidence RBAC group name.
MsGraph.Alert.Evidence.RemediationStatus String Evidence remediation status.
MsGraph.Alert.Evidence.RemediationStatusDetails Unknown Evidence remediation status details.
MsGraph.Alert.Evidence.RiskScore String Evidence risk score.
MsGraph.Alert.Evidence.Tags String Evidence tags.
MsGraph.Alert.Evidence.Verdict String Evidence verdict.
MsGraph.Alert.Evidence.Version String Evidence version.
MsGraph.Alert.Evidence.VmMetadata Unknown Evidence VM metadata.
MsGraph.Alert.FirstActivityDateTime Date Evidence first activity time.
MsGraph.Alert.IncidentId String Alert incident ID.
MsGraph.Alert.IncidentWebUrl String Alert incident URL.
MsGraph.Alert.LastActivityDateTime Date Alert last activity time.
MsGraph.Alert.LastUpdateDateTime Date Alert last update time.
MsGraph.Alert.ProviderAlertId String Alert provider ID.
MsGraph.Alert.RecommendedActions String Alert recommended action.
MsGraph.Alert.ResolvedDateTime Date Alert closing time.
MsGraph.Alert.ServiceSource String Alert service source.
MsGraph.Alert.TenantId String Alert tenant ID.
MsGraph.Alert.ThreatDisplayName Unknown Alert threat display name.
MsGraph.Alert.ThreatFamilyName Unknown Alert threat family name.

Human Readable Output

Microsoft Security Graph Alerts

ID IncidentId Status Severity DetectionSource ServiceSource Title Category CreatedDate LastUpdateDateTime
id new medium customTi microsoftDefenderForEndpoint test alert None 2022-10-03T03:39:21.7562976Z 2023-04-17T11:01:31.7566667Z

msg-get-alert-details

Get details for a specific alert.

Base Command

msg-get-alert-details

Input

Argument Name Description Required
alert_id The alert ID - Provider-generated GUID/unique identifier. Required

Context Output

Path Type Description
MsGraph.Alert.ID string Alert ID.
MsGraph.Alert.Title string Alert title.
MsGraph.Alert.Category string Alert category.
MsGraph.Alert.Severity string Alert severity.
MsGraph.Alert.CreatedDate date Alert created date.
MsGraph.Alert.Status string Alert status.
MsGraph.Alert.@odata.Context String Alert odata context.
MsGraph.Alert.ActorDisplayName Unknown Alert actor name.
MsGraph.Alert.AlertWebUrl String Alert web URL.
MsGraph.Alert.AssignedTo Unknown Alert assignee.
MsGraph.Alert.Classification Unknown Alert classification.
MsGraph.Alert.Comments.Comment String Alert comment.
MsGraph.Alert.Comments.CreatedByDisplayName String Alert comment creator name.
MsGraph.Alert.Comments.CreatedDate Date Alert comment creation time.
MsGraph.Alert.Description String Alert description.
MsGraph.Alert.DetectionSource String Alert detection source.
MsGraph.Alert.DetectorId String Alert detector ID.
MsGraph.Alert.Determination Unknown Alert determination.
MsGraph.Alert.Evidence.@odata.Type String Alert evidence.
MsGraph.Alert.Evidence.CreatedDate Date Evidence creation time.
MsGraph.Alert.Evidence.DetectionStatus Unknown Evidence detection status.
MsGraph.Alert.Evidence.ImageFile.FileName String Evidence image file name.
MsGraph.Alert.Evidence.ImageFile.FilePath String Evidence image file path.
MsGraph.Alert.Evidence.ImageFile.FilePublisher Unknown Evidence image file publisher.
MsGraph.Alert.Evidence.ImageFile.FileSize Unknown Evidence image file size.
MsGraph.Alert.Evidence.ImageFile.Issuer Unknown Evidence image file issuer.
MsGraph.Alert.Evidence.ImageFile.Sha1 String Evidence image file SHA1 hash.
MsGraph.Alert.Evidence.ImageFile.Sha256 String Evidence image file SHA256 hash.
MsGraph.Alert.Evidence.ImageFile.Signer Unknown Evidence image file signer.
MsGraph.Alert.Evidence.MdeDeviceId Unknown Evidence MDE device ID.
MsGraph.Alert.Evidence.ParentProcessCreationDateTime Date Evidence parent process creation time.
MsGraph.Alert.Evidence.ParentProcessId Number Evidence parent process process ID.
MsGraph.Alert.Evidence.ParentProcessImageFile Unknown Evidence parent process image file.
MsGraph.Alert.Evidence.ProcessCommandLine String Evidence process command line.
MsGraph.Alert.Evidence.ProcessCreationDateTime Date Evidence process creation time.
MsGraph.Alert.Evidence.ProcessId Number Evidence process ID.
MsGraph.Alert.Evidence.RemediationStatus String Evidence remediation status.
MsGraph.Alert.Evidence.RemediationStatusDetails Unknown Evidence remediation status details.
MsGraph.Alert.Evidence.UserAccount.AccountName String Evidence user account name.
MsGraph.Alert.Evidence.UserAccount.AzureAdUserId Unknown Evidence user account Azure AD user ID.
MsGraph.Alert.Evidence.UserAccount.DisplayName String Evidence user account display name.
MsGraph.Alert.Evidence.UserAccount.DomainName Unknown Evidence user account domain name.
MsGraph.Alert.Evidence.UserAccount.UserPrincipalName Unknown Evidence user account user principal name.
MsGraph.Alert.Evidence.UserAccount.UserSid String Evidence user account user SID.
MsGraph.Alert.Evidence.Verdict String Evidence verdict.
MsGraph.Alert.Evidence.FileDetails.FileName String Evidence file details file name.
MsGraph.Alert.Evidence.FileDetails.FilePath String Evidence file details file path.
MsGraph.Alert.Evidence.FileDetails.FilePublisher Unknown Evidence file details file publisher.
MsGraph.Alert.Evidence.FileDetails.FileSize Unknown Evidence file details file size.
MsGraph.Alert.Evidence.FileDetails.Issuer Unknown Evidence file details file issuer.
MsGraph.Alert.Evidence.FileDetails.Sha1 String Evidence file details SHA1 hash.
MsGraph.Alert.Evidence.FileDetails.Sha256 String Evidence file details SHA256 hash.
MsGraph.Alert.Evidence.FileDetails.Signer Unknown Evidence file details file signer.
MsGraph.Alert.Evidence.CֹountryLetterCode Unknown Evidence country letter code.
MsGraph.Alert.Evidence.IpAddress String Evidence IP address.
MsGraph.Alert.Evidence.AzureAdDeviceId Unknown Evidence Azure AD device ID.
MsGraph.Alert.Evidence.DefenderAvStatus String Evidence Defender AV status.
MsGraph.Alert.Evidence.DeviceDnsName String Evidence device DNS name.
MsGraph.Alert.Evidence.FirstSeenDateTime Date Evidence first seen time.
MsGraph.Alert.Evidence.HealthStatus String Evidence health status.
MsGraph.Alert.Evidence.OnboardingStatus String Evidence onboarding status.
MsGraph.Alert.Evidence.OsBuild Unknown Evidence OS build.
MsGraph.Alert.Evidence.OsPlatform String Evidence OS platform.
MsGraph.Alert.Evidence.RbacGroupId Number Evidence RBAC group ID.
MsGraph.Alert.Evidence.RbacGroupName String Evidence RBAC group name.
MsGraph.Alert.Evidence.RiskScore String Evidence risk score.
MsGraph.Alert.Evidence.Version String Evidence version.
MsGraph.Alert.Evidence.VmMetadata Unknown Evidence VM metadata.
MsGraph.Alert.FirstActivityDateTime Date Evidence first activity time.
MsGraph.Alert.IncidentId String Alert incident ID.
MsGraph.Alert.IncidentWebUrl String Alert incident URL.
MsGraph.Alert.LastActivityDateTime Date Alert last activity time.
MsGraph.Alert.LastUpdateDateTime Date Alert last update time.
MsGraph.Alert.ProviderAlertId String Alert provider ID.
MsGraph.Alert.RecommendedActions String Alert recommended action.
MsGraph.Alert.ResolvedDateTime Date Alert closing time.
MsGraph.Alert.ServiceSource String Alert service source.
MsGraph.Alert.TenantId String Alert tenant ID.
MsGraph.Alert.ThreatDisplayName Unknown Alert threat display name.
MsGraph.Alert.ThreatFamilyName Unknown Alert threat family name.

Human Readable Output

Microsoft Security Graph Alert Details -

ID IncidentId Status Severity DetectionSource ServiceSource Title Category CreatedDate LastUpdateDateTime
new medium customTi microsoftDefenderForEndpoint test alert None 2022-10-03T03:39:21.7562976Z 2023-04-17T11:01:31.7566667Z

msg-update-alert

Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions using its reference ID.

Base Command

msg-update-alert

Input

Argument Name Description Required
alert_id The Alert ID. Provider-generated GUID/unique identifier. Required
assigned_to Name of the analyst the alert is assigned to for triage, investigation, or remediation. Optional
status Alert lifecycle status (stage). Possible values are: unknown, newAlert, inProgress, resolved, new. Optional
classification Use this field to update the alert’s classification. Possible values are: unknown, truePositive, falsePositive, informationalExpectedActivity. Optional
determination Use this field to update the alert’s determination. Possible values are: unknown, malware, phishing, other, securityTesting, multiStagedAttack, maliciousUserActivity, lineOfBusinessApplication, unwantedSoftware. Optional

Context Output

Path Type Description
MsGraph.Alert.ID string Alert ID.
MsGraph.Alert.Status string Alert status, will appear only if changed.

Human Readable Output

Alert has been successfully updated.

msg-create-alert-comment

Create a comment for an existing alert.

Base Command

msg-create-alert-comment

Input

Argument Name Description Required
alert_id The Alert ID - Provider-generated GUID/unique identifier. Required
comment The comment to add to each alert. Required

Context Output

Path Type Description
MsGraph.AlertComment.ID String The alert ID that the comment was added to.
MsGraph.AlertComment.Comments.Comment String The comment itself
MsGraph.AlertComment.Comments.CreatedByDisplayName String The comment’s creator display name
MsGraph.AlertComment.Comments.CreatedDate Date The comment’s creation time

Human Readable Output

Microsoft Security Graph Create Alert Comment -

comment createdByDisplayName createdDate
comment Cortex XSOAR MS Graph Dev 2023-04-17T10:57:18.5231438Z
comment Cortex XSOAR MS Graph Dev 2023-04-17T11:01:31.7427859Z
comment Cortex XSOAR MS Graph Dev 2023-04-17T13:30:22.3995128Z

ms-graph-security-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

ms-graph-security-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

eDiscovery Commands

msg-list-ediscovery-cases

Lists edicovery cases.

Base Command

msg-list-ediscovery-cases

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. If provided, only this id will be returned. Optional
limit The maximum number of results to return. Default is 50. Optional
all_results Show all results if true. Possible values are: true, false. Optional

Context Output

Path Type Description
MsGraph.eDiscoveryCase.CaseId String The ID of the eDiscovery case.
MsGraph.eDiscoveryCase.CaseStatus String The case status. Possible values are: unknown, active, pendingDelete, closing, closed, and closedWithError.
MsGraph.eDiscoveryCase.CreatedDateTime Date The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z
MsGraph.eDiscoveryCase.Description String The case description.
MsGraph.eDiscoveryCase.DisplayName String The case name.
MsGraph.eDiscoveryCase.ExternalId String The external case number for customer reference.
MsGraph.eDiscoveryCase.LastModifiedDateTime Date The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z
MsGraph.eDiscoveryCase.ClosedBy.User.DisplayName String The user who closed the case.
MsGraph.eDiscoveryCase.LastModifiedBy.User.DisplayName String The user who last modified the case.
MsGraph.eDiscoveryCase.ClosedDateTime Date The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z

Command example

!msg-list-ediscovery-cases limit=5

Context Example

{
    "MsGraph": {
        "eDiscoveryCase": [
            {
                "CaseId": "06386565-47d4-410b-96f9-007978319c02",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-18T10:55:12.63Z",
                "Description": "",
                "DisplayName": "a",
                "ExternalId": "123",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-20T12:25:05.797Z"
            },
            {
                "CaseId": "44bbe68b-0da1-42b4-9ad0-00e8b52f64e2",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-18T11:59:33.44Z",
                "Description": "",
                "DisplayName": "asassdda",
                "ExternalId": "",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-18T11:59:33.44Z"
            },
            {
                "CaseId": "f108b7fa-d177-438e-9679-01cd79e3df3f",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-20T07:08:01.95Z",
                "Description": "wrking",
                "DisplayName": "justw orkok?",
                "ExternalId": "",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-20T07:08:01.95Z"
            },
            {
                "CaseId": "f346c6f5-1d66-4fab-a46b-0abc99c2cef0",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-18T11:54:59.873Z",
                "Description": "",
                "DisplayName": "asasdda",
                "ExternalId": "",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-18T11:54:59.873Z"
            },
            {
                "CaseId": "1a346a94-5220-46ae-a821-0bbbadf4009d",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-12T07:05:27.557Z",
                "Description": "Test Case 104 description",
                "DisplayName": "Test Case 104",
                "ExternalId": "",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-12T07:05:27.557Z"
            }
        ]
    }
}

Human Readable Output

Results

Display Name Description External Id Case Status Case Id Created Date Time Last Modified Date Time Last Modified By Name
a   123 active 06386565-47d4-410b-96f9-007978319c02 2023-06-18T10:55:12.63Z 2023-06-20T12:25:05.797Z Content Test
asassdda     active 44bbe68b-0da1-42b4-9ad0-00e8b52f64e2 2023-06-18T11:59:33.44Z 2023-06-18T11:59:33.44Z Content Test
justw orkok? wrking   active f108b7fa-d177-438e-9679-01cd79e3df3f 2023-06-20T07:08:01.95Z 2023-06-20T07:08:01.95Z Content Test
asasdda     active f346c6f5-1d66-4fab-a46b-0abc99c2cef0 2023-06-18T11:54:59.873Z 2023-06-18T11:54:59.873Z Content Test
Test Case 104 Test Case 104 description   active 1a346a94-5220-46ae-a821-0bbbadf4009d 2023-06-12T07:05:27.557Z 2023-06-12T07:05:27.557Z Content Test

msg-create-ediscovery-case

Create a new eDiscovery case. This command only creates an eDiscovery (Premium) case using the new case format. To learn more about the new case format in eDiscovery, see https://learn.microsoft.com/en-us/microsoft-365/compliance/advanced-ediscovery-new-case-format.

Base Command

msg-create-ediscovery-case

Input

Argument Name Description Required
display_name The name of the eDiscovery case. Required
description The case description. Optional
external_id The external case number for customer reference. Optional

Context Output

Path Type Description
MsGraph.eDiscoveryCase.CaseId String The ID of the eDiscovery case.
MsGraph.eDiscoveryCase.CaseStatus String The case status. Possible values are unknown, active, pendingDelete, closing, closed, and closedWithError.
MsGraph.eDiscoveryCase.CreatedDateTime Date The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z
MsGraph.eDiscoveryCase.Description String The case description.
MsGraph.eDiscoveryCase.DisplayName String The case name.
MsGraph.eDiscoveryCase.ExternalId String The external case number for customer reference.
MsGraph.eDiscoveryCase.LastModifiedDateTime Date The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z

Command example

!msg-create-ediscovery-case display_name=`my case name11234` external_id=123 description=`description of the case`

Context Example

{
    "MsGraph": {
        "eDiscoveryCase": {
            "CaseId": "6dfd17fe-43c5-411f-a194-abdc9492bfa0",
            "CaseStatus": "active",
            "CreatedDateTime": "2023-07-06T07:42:34.897Z",
            "Description": "description of the case",
            "DisplayName": "my case name11234",
            "ExternalId": "123",
            "LastModifiedDateTime": "2023-07-06T07:42:34.897Z"
        }
    }
}

Human Readable Output

Results

Display Name Description External Id Case Status Case Id Created Date Time Last Modified Date Time
my case name11234 description of the case 123 active 6dfd17fe-43c5-411f-a194-abdc9492bfa0 2023-07-06T07:42:34.897Z 2023-07-06T07:42:34.897Z

msg-update-ediscovery-case

Update an eDiscovery case.

Base Command

msg-update-ediscovery-case

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
display_name The name of the eDiscovery case. Required
description The case description. Optional
external_id The external case number for customer reference. Optional

Context Output

There is no context output for this command.

Command example

!msg-update-ediscovery-case case_id=6dfd17fe-43c5-411f-a194-abdc9492bfa0 display_name=`new display name` external_id=123 description=`new description of the case`

Human Readable Output

Case with id 6dfd17fe-43c5-411f-a194-abdc9492bfa0 was updated successfully.

msg-close-ediscovery-case

Close an eDiscovery case.
When the legal case or investigation supported by a eDiscovery (Standard) case is completed, you can close the case. Here’s what happens when you close a case:
If the case contains any eDiscovery holds, they’ll be turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This helps prevent content from being immediately deleted and provides admins the opportunity to search for and restore content before it may be permanently deleted after the delay hold period expires. For more information, see Removing content locations from an eDiscovery hold.
Closing a case only turns off the holds that are associated with that case. If other holds are placed on a content location (such as a Litigation Hold, a retention policy, or a hold from a different eDiscovery (Standard) case) those holds will still be maintained.
The case is still listed on the eDiscovery (Standard) page in the Microsoft Purview compliance portal. The details, holds, searches, and members of a closed case are retained.
You can edit a case after it’s closed. For example, you can add or remove members, create searches, and export search results. The primary difference between active and closed cases is that eDiscovery holds are turned off when a case is closed.

Base Command

msg-close-ediscovery-case

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required

Context Output

There is no context output for this command.

Command example

!msg-close-ediscovery-case case_id=6dfd17fe-43c5-411f-a194-abdc9492bfa0

Human Readable Output

Case with id 6dfd17fe-43c5-411f-a194-abdc9492bfa0 was closed successfully.

msg-reopen-ediscovery-case

Reopen an eDiscovery case. When you reopen an eDiscovery (Premium) case, any holds that were in place when the case was closed won’t be automatically reinstated. After the case is reopened, you’ll have to go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, and then set the Status toggle to On.

Base Command

msg-reopen-ediscovery-case

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required

Context Output

There is no context output for this command.

Command example

!msg-reopen-ediscovery-case case_id=6dfd17fe-43c5-411f-a194-abdc9492bfa0

Human Readable Output

Case with id 6dfd17fe-43c5-411f-a194-abdc9492bfa0 was reopened successfully.

msg-delete-ediscovery-case

Delete an eDiscovery case. Before you can delete a case, you must first delete all holds listed on the holds page of the case. That includes deleting holds with a status of Off. Default hold policies can only be deleted when the hold is turned off. You must close an active case to turn off any default hold policies in the case. Once the holds are turned off for default hold policies, they can be deleted.

Base Command

msg-delete-ediscovery-case

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required

Context Output

There is no context output for this command.

Command example

!msg-delete-ediscovery-case case_id=6dfd17fe-43c5-411f-a194-abdc9492bfa0

Human Readable Output

Case was deleted successfully.

msg-create-ediscovery-custodian

Create a new ediscoveryCustodian object. After the custodian object is created, you will need to create the custodian’s userSource to reference their mailbox and OneDrive for Business site.

Base Command

msg-create-ediscovery-custodian

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
email Custodian’s primary SMTP address. Required

Context Output

Path Type Description
MsGraph.eDiscoveryCustodian.CreatedDateTime Date Date and time when the custodian was added to the case.
MsGraph.eDiscoveryCustodian.CustodianId String The ID for the custodian in the specified case. Read-only.
MsGraph.eDiscoveryCustodian.CustodianStatus String Status of the custodian. Possible values are: active, released.
MsGraph.eDiscoveryCustodian.DisplayName String Display name of the custodian.
MsGraph.eDiscoveryCustodian.Email String Email address of the custodian.
MsGraph.eDiscoveryCustodian.HoldStatus String The hold status of the custodian.The possible values are: notApplied, applied, applying, removing, partial.
MsGraph.eDiscoveryCustodian.LastModifiedDateTime Date Date and time the custodian object was last modified.

Command example

!msg-create-ediscovery-custodian case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 email=testbox2@yoursite.onmicrosoft.com

Context Example

{
    "MsGraph": {
        "eDiscoveryCustodian": {
            "CreatedDateTime": "2023-07-06T07:53:36.9441479Z",
            "CustodianId": "0af7ca2b84bc4cff930d5d301cc4caf3",
            "CustodianStatus": "active",
            "DisplayName": "testbox2",
            "Email": "yourmail@yoursite.onmicrosoft.com",
            "HoldStatus": "notApplied",
            "LastModifiedDateTime": "2023-07-06T07:53:36.9441479Z"
        }
    }
}

Human Readable Output

Results

Display Name Email Custodian Status Custodian Id Created Date Time Last Modified Date Time Hold Status
testbox2 yourmail@yoursite.onmicrosoft.com active 0af7ca2b84bc4cff930d5d301cc4caf3 2023-07-06T07:53:36.9441479Z 2023-07-06T07:53:36.9441479Z notApplied

msg-list-ediscovery-custodians

List custodians on a given eDiscovery case.

Base Command

msg-list-ediscovery-custodians

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
custodian_id The ID of the custodian on the given eDiscovery case. If provided, only this ID will be returned. Optional
limit Number of total results to return. Default is 50. Optional
all_results Show all results if true. Possible values are: true, false. Optional

Context Output

Path Type Description
MsGraph.eDiscoveryCustodian.CreatedDateTime Date Date and time when the custodian was added to the case.
MsGraph.eDiscoveryCustodian.CustodianId String The ID for the custodian in the specified case. Read-only.
MsGraph.eDiscoveryCustodian.CustodianStatus String Status of the custodian. Possible values are: active, released.
MsGraph.eDiscoveryCustodian.DisplayName String Display name of the custodian.
MsGraph.eDiscoveryCustodian.Email String Email address of the custodian.
MsGraph.eDiscoveryCustodian.HoldStatus String The hold status of the custodian. The possible values are: notApplied, applied, applying, removing, partial.
MsGraph.eDiscoveryCustodian.LastModifiedDateTime Date Date and time the custodian object was last modified.
MsGraph.eDiscoveryCustodian.ReleasedDateTime Date Date and time the custodian was released from the case.

Command example

!msg-list-ediscovery-custodians all_results=true case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Context Example

{
    "MsGraph": {
        "eDiscoveryCustodian": {
            "CreatedDateTime": "2023-07-06T07:53:36.9441479Z",
            "CustodianId": "0af7ca2b84bc4cff930d5d301cc4caf3",
            "CustodianStatus": "active",
            "DisplayName": "testbox2",
            "Email": "mail@yoursite.onmicrosoft.com",
            "HoldStatus": "notApplied",
            "LastModifiedDateTime": "2023-07-06T07:53:36.9441479Z"
        }
    }
}

Human Readable Output

Results

Display Name Email Custodian Status Custodian Id Created Date Time Last Modified Date Time Hold Status
testbox2 mail@yoursite.onmicrosoft.com active 0af7ca2b84bc4cff930d5d301cc4caf3 2023-07-06T07:53:36.9441479Z 2023-07-06T07:53:36.9441479Z notApplied

msg-activate-ediscovery-custodian

Activate a custodian that has been released from a case to make them part of the case again. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery-manage-new-custodians?view=o365-worldwide#re-activate-custodian.

Base Command

msg-activate-ediscovery-custodian

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
custodian_id The ID of the eDiscovery case. on the given eDiscovery case. Required

Context Output

There is no context output for this command.

Command example

!msg-activate-ediscovery-custodian custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Human Readable Output

Custodian with id 0af7ca2b84bc4cff930d5d301cc4caf3 Case was reactivated on case with id 84abfff1-dd69-4559-8f4e-8225e0d505c5 successfully.

msg-release-ediscovery-custodian

Release a custodian from a case. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/manage-new-custodians#release-a-custodian-from-a-case.

Base Command

msg-release-ediscovery-custodian

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
custodian_id The ID of the eDiscovery case. on the given eDiscovery case. Required

Context Output

There is no context output for this command.

Command example

!msg-release-ediscovery-custodian custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Human Readable Output

Custodian with id 0af7ca2b84bc4cff930d5d301cc4caf3 was released from case with id 84abfff1-dd69-4559-8f4e-8225e0d505c5 successfully.

msg-create-ediscovery-custodian-site-source

Create a new siteSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

Base Command

msg-create-ediscovery-custodian-site-source

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
custodian_id The ID of the eDiscovery case. on the given eDiscovery case. Required
site URL of the site; for example, https://contoso.sharepoint.com/sites/HumanResources. Required

Context Output

Path Type Description
MsGraph.CustodianSiteSource.CreatedBy.Application.DisplayName String The name of the application who created the siteSource.
MsGraph.CustodianSiteSource.CreatedBy.Application.ID String The ID of the application who created the siteSource.
MsGraph.CustodianSiteSource.CreatedBy.User.DisplayName String The name of the user who created the siteSource.
MsGraph.CustodianSiteSource.CreatedBy.User.ID String The ID of the user who created the siteSource.
MsGraph.CustodianSiteSource.CreatedBy.User.UserPrincipalName String Internet-style login name of the user who created the siteSource.
MsGraph.CustodianSiteSource.CreatedDateTime Date The date and time the siteSource was created.
MsGraph.CustodianSiteSource.DisplayName String The display name of the siteSource. This will be the name of the SharePoint site.
MsGraph.CustodianSiteSource.HoldStatus String The hold status of the siteSource. The possible values are: notApplied, applied, applying, removing, partial.
MsGraph.CustodianSiteSource.SiteSourceId String The ID of the siteSource.

Command example

!msg-create-ediscovery-custodian-site-source custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 site=https://yourdev.sharepoint.com/sites/site_test_1

Context Example

{
    "MsGraph": {
        "CustodianSiteSource": {
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "0001-01-01T00:00:00Z",
            "DisplayName": "site_test_1",
            "HoldStatus": "notApplied",
            "SiteSourceId": "862f0a64-e7db-46e0-a97f-9156b4f693ee"
        }
    }
}

Human Readable Output

Results

Display Name Site Source Id Hold Status Created Date Time Created By Name Created By UPN Created By App Name
site_test_1 862f0a64-e7db-46e0-a97f-9156b4f693ee notApplied 0001-01-01T00:00:00Z Content Test ContentTest@yoursite.onmicrosoft.com Cortex XSOAR - MS Graph Security Dev

msg-create-ediscovery-custodian-user-source

Create a new userSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

Base Command

msg-create-ediscovery-custodian-user-source

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
custodian_id The ID of the eDiscovery case. on the given eDiscovery case. Required
email SMTP address of the user. Required
included_sources Specifies which sources are included in this group. Possible values are: mailbox, site, mailbox, site. Required

Context Output

Path Type Description
MsGraph.CustodianUserSource.CreatedBy.Application.DisplayName String The name of the application who created the userSource.
MsGraph.CustodianUserSource.CreatedBy.Application.ID String The ID of the application who created the userSource.
MsGraph.CustodianUserSource.CreatedBy.User.DisplayName String The name of the user who created the userSource.
MsGraph.CustodianUserSource.CreatedBy.User.ID String The ID of the user who created the userSource.
MsGraph.CustodianUserSource.CreatedBy.User.UserPrincipalName String Internet-style login name of the user who created the userSource.
MsGraph.CustodianUserSource.CreatedDateTime Date The date and time the userSource was created.
MsGraph.CustodianUserSource.DisplayName String The display name associated with the mailbox and site.
MsGraph.CustodianUserSource.Email String Email address of the user’s mailbox.
MsGraph.CustodianUserSource.HoldStatus String The hold status of the userSource. The possible values are: notApplied, applied, applying, removing, partial.
MsGraph.CustodianUserSource.IncludedSources String Specifies which sources are included in this group. Possible values are: mailbox, site.
MsGraph.CustodianUserSource.UserSourceId String The ID of the userSource. This is not The ID of the actual group.

Command example

!msg-create-ediscovery-custodian-user-source custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 email=testbox2@yoursite.onmicrosoft.com included_sources="mailbox, site"

Context Example

{
    "MsGraph": {
        "CustodianUserSource": {
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "0001-01-01T00:00:00Z",
            "DisplayName": "testbox2",
            "Email": "testbox2@yoursite.onmicrosoft.com",
            "HoldStatus": "notApplied",
            "IncludedSources": "mailbox,site",
            "UserSourceId": "0af7ca2b-84bc-4cff-930d-5d301cc4caf3"
        }
    }
}

Human Readable Output

Results

Display Name Email User Source Id Hold Status Created Date Time Created By Name Created By UPN Created By App Name Included Sources
testbox2 testbox2@yoursite.onmicrosoft.com 0af7ca2b-84bc-4cff-930d-5d301cc4caf3 notApplied 0001-01-01T00:00:00Z Content Test ContentTest@yoursite.onmicrosoft.com Cortex XSOAR - MS Graph Security Dev mailbox,site

msg-list-ediscovery-custodian-user-sources

Get a list of the userSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

Base Command

msg-list-ediscovery-custodian-user-sources

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
custodian_id The ID of the eDiscovery case. on the given eDiscovery case. Required
user_source_id The ID of the userSource. If provided, only this id will be returned. Optional
limit Number of total results to return. Default is 50. Optional
all_results Show all results if true. Possible values are: true, false. Optional

Context Output

Path Type Description
MsGraph.CustodianUserSource.CreatedBy.Application.DisplayName String The name of the application who created the userSource.
MsGraph.CustodianUserSource.CreatedBy.Application.ID String The ID of the application who created the userSource.
MsGraph.CustodianUserSource.CreatedBy.User.DisplayName String The name of the user who created the userSource.
MsGraph.CustodianUserSource.CreatedBy.User.ID String The ID of the user who created the userSource.
MsGraph.CustodianUserSource.CreatedBy.User.UserPrincipalName String Internet-style login name of the user who created the userSource.
MsGraph.CustodianUserSource.CreatedDateTime Date The date and time the userSource was created.
MsGraph.CustodianUserSource.DisplayName String The display name associated with the mailbox and site.
MsGraph.CustodianUserSource.Email String Email address of the user’s mailbox.
MsGraph.CustodianUserSource.HoldStatus String The hold status of the userSource. The possible values are: notApplied, applied, applying, removing, partial.
MsGraph.CustodianUserSource.IncludedSources String Specifies which sources are included in this group. Possible values are: mailbox, site.
MsGraph.CustodianUserSource.SiteWebUrl String The URL of the user’s OneDrive for Business site. Read-only.
MsGraph.CustodianUserSource.UserSourceId String The ID of the userSource. This is not The ID of the actual group.

Command example

!msg-list-ediscovery-custodian-user-sources custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Context Example

{
    "MsGraph": {
        "CustodianUserSource": {
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "2023-07-06T08:04:21.1548801Z",
            "DisplayName": "testbox2",
            "Email": "testbox2@yoursite.onmicrosoft.com",
            "HoldStatus": "notApplied",
            "IncludedSources": "mailbox,site",
            "SiteWebUrl": "https://yourdev-my.sharepoint.com/personal/testbox2_yourdev_onmicrosoft_com",
            "UserSourceId": "0af7ca2b-84bc-4cff-930d-5d301cc4caf3"
        }
    }
}

Human Readable Output

Results

Display Name Email User Source Id Hold Status Created Date Time Created By Name Created By UPN Created By App Name Site Web Url Included Sources
testbox2 testbox2@yoursite.onmicrosoft.com 0af7ca2b-84bc-4cff-930d-5d301cc4caf3 notApplied 2023-07-06T08:04:21.1548801Z Content Test ContentTest@yoursite.onmicrosoft.com Cortex XSOAR - MS Graph Security Dev https://yourdev-my.sharepoint.com/personal/testbox2_yourdev_onmicrosoft_com mailbox,site

msg-list-ediscovery-custodian-site-sources

Get a list of the siteSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

Base Command

msg-list-ediscovery-custodian-site-sources

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
custodian_id The ID of the eDiscovery case. on the given eDiscovery case. Required
site_source_id The ID of the siteSource. If provided, only this id will be returned. Optional
limit Number of total results to return. Default is 50. Optional
all_results Show all results if true. Possible values are: true, false. Optional

Context Output

Path Type Description
MsGraph.CustodianSiteSource.CreatedBy.Application.DisplayName String The name of the application who created the siteSource.
MsGraph.CustodianSiteSource.CreatedBy.Application.ID String The ID of the application who created the siteSource.
MsGraph.CustodianSiteSource.CreatedBy.User.DisplayName String The name of the user who created the siteSource.
MsGraph.CustodianSiteSource.CreatedBy.User.ID String The ID of the user who created the siteSource.
MsGraph.CustodianSiteSource.CreatedBy.User.UserPrincipalName String Internet-style login name of the user who created the siteSource.
MsGraph.CustodianSiteSource.CreatedDateTime Date The date and time the siteSource was created.
MsGraph.CustodianSiteSource.DisplayName String The display name of the siteSource. This will be the name of the SharePoint site.
MsGraph.CustodianSiteSource.HoldStatus String The hold status of the siteSource. The possible values are: notApplied, applied, applying, removing, partial.
MsGraph.CustodianSiteSource.SiteSourceId String The ID of the siteSource.
MsGraph.CustodianSiteSource.Site.ID String The unique identifier of the item. Read-only.
MsGraph.CustodianSiteSource.Site.WebUrl String URL that displays the item in the browser. Read-only.
MsGraph.CustodianSiteSource.Site.CreatedDate Date The date and time the siteSource was created.

Command example

!msg-list-ediscovery-custodian-site-sources custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 site_source_id=862f0a64-e7db-46e0-a97f-9156b4f693ee

Context Example

{
    "MsGraph": {
        "CustodianSiteSource": {
            "CreatedBy": {
                "User": {
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b"
                }
            },
            "CreatedDateTime": "2023-07-06T08:02:28.5670187Z",
            "DisplayName": "site_test_1",
            "HoldStatus": "removing",
            "Site": {
                "CreatedDate": "2023-07-06T08:02:28.5670187Z",
                "ID": "862f0a64-e7db-46e0-a97f-9156b4f693ee",
                "WebUrl": "https://yourdev.sharepoint.com/sites/site_test_1"
            },
            "SiteSourceId": "862f0a64-e7db-46e0-a97f-9156b4f693ee"
        }
    }
}

Human Readable Output

Results

Display Name Site Source Id Hold Status Created Date Time
site_test_1 862f0a64-e7db-46e0-a97f-9156b4f693ee removing 2023-07-06T08:02:28.5670187Z

msg-apply-hold-ediscovery-custodian

Start the process of applying hold on eDiscovery custodians.
Available return statuses:
notApplied - The custodian is not on hold (all sources in it are not on hold).
applied - The custodian is on hold (all sources are on hold).
applying - The custodian is in applying hold state (applyHold operation triggered).
removing - The custodian is in removing the hold state(removeHold operation triggered).
partial - The custodian is in mixed state where some sources are on hold and some not on hold or error state.

Base Command

msg-apply-hold-ediscovery-custodian

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
custodian_id A comma-seperated list of custodians ids to apply a hold to. Required

Context Output

There is no context output for this command.

Command example

!msg-apply-hold-ediscovery-custodian custodian_id=09f05c43ffc54ff88cf5c5e89699375d,0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Human Readable Output

Apply hold status is running.

msg-remove-hold-ediscovery-custodian

Start the process of removing hold from eDiscovery custodians.

Base Command

msg-remove-hold-ediscovery-custodian

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
custodian_id A comma-seperated list of custodians ids to remove a hold from. Required

Context Output

There is no context output for this command.

Command example

!msg-remove-hold-ediscovery-custodian custodian_id=09f05c43ffc54ff88cf5c5e89699375d,0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Human Readable Output

Remove hold status is running.

msg-create-ediscovery-non-custodial-data-source

Create a new eDiscoveryNoncustodialDataSource object.

Base Command

msg-create-ediscovery-non-custodial-data-source

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
site URL of the site, for example, https://contoso.sharepoint.com/sites/HumanResources. Optional
email Email address of the user’s mailbox. Optional

Context Output

Path Type Description
MsGraph.NoncustodialDataSource.CreatedDateTime Date Created date and time of the nonCustodialDataSource.
MsGraph.NoncustodialDataSource.DataSourceId String Unique identifier of the nonCustodialDataSource.
MsGraph.NoncustodialDataSource.DataSourceStatus String Latest status of the nonCustodialDataSource. Possible values are: Active, Released.
MsGraph.NoncustodialDataSource.DisplayName String Display name of the noncustodialDataSource.
MsGraph.NoncustodialDataSource.HoldStatus String The hold status of the nonCustodialDataSource.The possible values are: notApplied, applied, applying, removing, partial
MsGraph.NoncustodialDataSource.LastModifiedDateTime Date Last modified date and time of the nonCustodialDataSource.
MsGraph.NoncustodialDataSource.ReleasedDateTime Date Date and time that the nonCustodialDataSource was released from the case.

Command example

!msg-create-ediscovery-non-custodial-data-source case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 site=https://yourdev.sharepoint.com/sites/site_test_1

Context Example

{
    "MsGraph": {
        "NoncustodialDataSource": {
            "CreatedDateTime": "2023-07-06T08:22:32.3121523Z",
            "DataSourceId": "38394332433939353236344630434633",
            "DataSourceStatus": "active",
            "DisplayName": "site_test_1",
            "HoldStatus": "notApplied",
            "LastModifiedDateTime": "2023-07-06T08:22:32.3121523Z",
            "ReleasedDateTime": "0001-01-01T00:00:00Z"
        }
    }
}

Human Readable Output

Results

Created Date Time Data Source Id Data Source Status Display Name Hold Status Last Modified Date Time Released Date Time
2023-07-06T08:22:32.3121523Z 38394332433939353236344630434633 active site_test_1 notApplied 2023-07-06T08:22:32.3121523Z 0001-01-01T00:00:00Z

msg-list-ediscovery-non-custodial-data-sources

Get a list of the non-custodial data sources and their properties.

Base Command

msg-list-ediscovery-non-custodial-data-sources

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
data_source_id The ID of the dataSource. If provided, only this id will be returned. Optional
limit The maximum number of results to return. Default is 50. Optional
all_results Show all results if true. Possible values are: true, false. Optional

Context Output

Path Type Description
MsGraph.NoncustodialDataSource.CreatedDateTime Date Created date and time of the nonCustodialDataSource.
MsGraph.NoncustodialDataSource.DataSourceId String Unique identifier of the nonCustodialDataSource.
MsGraph.NoncustodialDataSource.DataSourceStatus String Latest status of the nonCustodialDataSource. Possible values are: Active, Released.
MsGraph.NoncustodialDataSource.DisplayName String Display name of the noncustodialDataSource.
MsGraph.NoncustodialDataSource.HoldStatus String The hold status of the nonCustodialDataSource.The possible values are: notApplied, applied, applying, removing, partial
MsGraph.NoncustodialDataSource.LastModifiedDateTime Date Last modified date and time of the nonCustodialDataSource.
MsGraph.NoncustodialDataSource.ReleasedDateTime Date Date and time that the nonCustodialDataSource was released from the case.

Command example

!msg-list-ediscovery-non-custodial-data-sources case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Context Example

{
    "MsGraph": {
        "NoncustodialDataSource": {
            "CreatedDateTime": "2023-07-06T08:22:32.3121523Z",
            "DataSourceId": "38394332433939353236344630434633",
            "DisplayName": "site_test_1",
            "HoldStatus": "notApplied",
            "LastModifiedDateTime": "2023-07-06T08:22:32.3121523Z",
            "ReleasedDateTime": "0001-01-01T00:00:00Z",
            "Status": "active"
        }
    }
}

Human Readable Output

Results

Display Name Data Source Id Hold Status Created Date Time Last Modified Date Time Released Date Time Status
site_test_1 38394332433939353236344630434633 notApplied 2023-07-06T08:22:32.3121523Z 2023-07-06T08:22:32.3121523Z 0001-01-01T00:00:00Z active

msg-create-ediscovery-search

Create a new eDiscoverySearch object.

Base Command

msg-create-ediscovery-search

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
display_name The display name of the search. Required
description The description of the search. Optional
content_query The query string used for the search. The query string format is KQL (Keyword Query Language). For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions.. You can refine searches by using fields paired with values; for example, subject:”Quarterly Financials” AND Date>=06/01/2016 AND Date<=07/01/2016. Optional
data_source_scopes When specified, the collection will span across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources. Optional

Context Output

Path Type Description
MsGraph.eDiscoverySearch.ContentQuery String The query string in KQL (Keyword Query Language) query. For details, see see https://learn.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions.. You can refine searches by using fields paired with values; for example, subject:”Quarterly Financials” AND Date>=06/01/2016 AND Date<=07/01/2016.
MsGraph.eDiscoverySearch.CreatedBy.Application.DisplayName String Name of the application who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedBy.Application.ID String ID of the application who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedBy.User.DisplayName String Name of the user who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedBy.User.ID String ID of the user who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedBy.User.UserPrincipalName String Internet-style login name of the user who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedDateTime Date The date and time the eDiscovery search was created.
MsGraph.eDiscoverySearch.DataSourceScopes String When specified, the collection will span across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources.
MsGraph.eDiscoverySearch.Description String The description of the eDiscovery search.
MsGraph.eDiscoverySearch.DisplayName String The display name of the eDiscovery search.
MsGraph.eDiscoverySearch.LastModifiedDateTime Date The last date and time the eDiscovery search was modified.
MsGraph.eDiscoverySearch.SearchId String The ID for the eDiscovery search.

Command example

!msg-create-ediscovery-search case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 display_name=`my search` data_source_scopes=allCaseNoncustodialDataSources

Context Example

{
    "MsGraph": {
        "eDiscoverySearch": {
            "ContentQuery": "",
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "2023-07-06T08:25:36.9874937Z",
            "DataSourceScopes": "allCaseNoncustodialDataSources",
            "Description": "",
            "DisplayName": "my search",
            "LastModifiedDateTime": "2023-07-06T08:25:36.9874937Z",
            "SearchId": "e7282eff-ba81-43cb-9027-522a343f6692"
        }
    }
}

Human Readable Output

Results

Display Name Data Source Scopes Search Id Created By Name Created By App Name Created By UPN Created Date Time Last Modified Date Time
my search allCaseNoncustodialDataSources e7282eff-ba81-43cb-9027-522a343f6692 Content Test Cortex XSOAR - MS Graph Security Dev ContentTest@yoursite.onmicrosoft.com 2023-07-06T08:25:36.9874937Z 2023-07-06T08:25:36.9874937Z

msg-update-ediscovery-search

Update an eDiscoverySearch object.

Base Command

msg-update-ediscovery-search

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
search_id The ID of the eDiscovery search. Required
display_name The display name of the search. Required
description The description of the search. Optional
content_query The query string used for the search. The query string format is KQL (Keyword Query Language). For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values, for example, subject:”Quarterly Financials” AND Date>=06/01/2016 AND Date<=07/01/2016. Optional
data_source_scopes When specified, the collection will span across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources. Optional

Context Output

There is no context output for this command.

Command example

!msg-update-ediscovery-search case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 display_name=newname search_id=e7282eff-ba81-43cb-9027-522a343f6692

Human Readable Output

eDiscovery search e7282eff-ba81-43cb-9027-522a343f6692 was updated successfully.

msg-list-ediscovery-searchs

Get the list of eDiscoverySearch resources from an eDiscovery case.

Base Command

msg-list-ediscovery-searchs

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
search_id The ID of the eDiscovery search. If provided, only this id will be returned. Optional
limit The maximum number of results to return. Default is 50. Optional
all_results Show all results if true. Possible values are: true, false. Optional

Context Output

Path Type Description
MsGraph.eDiscoverySearch.ContentQuery String The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:”Quarterly Financials” AND Date>=06/01/2016 AND Date<=07/01/2016.
MsGraph.eDiscoverySearch.CreatedBy.Application.DisplayName String Name of the application who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedBy.Application.ID String ID of the application who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedBy.User.DisplayName String Name of the user who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedBy.User.ID String ID of the user who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedBy.User.UserPrincipalName String Internet-style login name of the user who created the eDiscovery search.
MsGraph.eDiscoverySearch.CreatedDateTime Date The date and time the eDiscovery search was created.
MsGraph.eDiscoverySearch.DataSourceScopes String When specified, the collection will span across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources.
MsGraph.eDiscoverySearch.Description String The description of the eDiscovery search.
MsGraph.eDiscoverySearch.DisplayName String The display name of the eDiscovery search.
MsGraph.eDiscoverySearch.SearchId String The ID for the eDiscovery search.
MsGraph.eDiscoverySearch.LastModifiedDateTime String The last date and time the eDiscovery search was modified.
MsGraph.eDiscoverySearch.LastModifiedBy.Application.DisplayName String Name of the application who last modified the eDiscovery search.
MsGraph.eDiscoverySearch.LastModifiedBy.Application.ID String ID of the application who last modified the eDiscovery search.
MsGraph.eDiscoverySearch.LastModifiedBy.User.DisplayName String Name of the user who last modified the eDiscovery search.
MsGraph.eDiscoverySearch.LastModifiedBy.User.ID String ID of the user who last modified the eDiscovery search.
MsGraph.eDiscoverySearch.LastModifiedBy.User.UserPrincipalName String Internet-style login name of the user who last modified the eDiscovery search.

Command example

!msg-list-ediscovery-searchs case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Context Example

{
    "MsGraph": {
        "eDiscoverySearch": {
            "ContentQuery": "",
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "2023-07-06T08:25:36.9874937Z",
            "DataSourceScopes": "allCaseNoncustodialDataSources",
            "Description": "",
            "DisplayName": "newname",
            "LastModifiedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "LastModifiedDateTime": "2023-07-06T08:27:51.5611704Z",
            "SearchId": "e7282eff-ba81-43cb-9027-522a343f6692"
        }
    }
}

Human Readable Output

Results

Display Name Data Source Scopes Search Id Created By Name Created By App Name Created By UPN Created Date Time Last Modified Date Time
newname allCaseNoncustodialDataSources e7282eff-ba81-43cb-9027-522a343f6692 Content Test Cortex XSOAR - MS Graph Security Dev ContentTest@yoursite.onmicrosoft.com 2023-07-06T08:25:36.9874937Z 2023-07-06T08:27:51.5611704Z

msg-purge-ediscovery-data

Deletes mailbox items in Exchange or messages in Microsoft Teams that are included in an eDiscovery search.

You can collect and purge the following categories of Teams content:

Teams 1:1 chats - Chat messages, posts, and attachments shared in a Teams conversation between two people. Teams 1:1 chats are also called conversations.
Teams group chats - Chat messages, posts, and attachments shared in a Teams conversation between three or more people. Also called 1:N chats or group conversations.
Teams channels - Chat messages, posts, replies, and attachments shared in a standard Teams channel.
Private channels - Message posts, replies, and attachments shared in a private Teams channel.
Shared channels - Message posts, replies, and attachments shared in a shared Teams channel.

Base Command

msg-purge-ediscovery-data

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
search_id The ID of the eDiscovery search. Required
purge_type Whether the action is soft delete or hard delete. Possible values are: permanentlyDelete, recoverable. Optional
purge_areas Define the locations to be in scope of the purge action. Possible values are: teamsMessages, mailboxes. Optional

Context Output

Path Type Description
MsGraph.eDiscoveryCase.Purge.OperationID String The ID of the purge operation. Use this ID to retrieve the operation status via ‘msg-list-case-operation’.
MsGraph.eDiscoveryCase.Purge.Status String The status of the purge operation.

Command example

!msg-purge-ediscovery-data case_id=00000000-0000-0000-0000-000000000000 search_id=11111111-1111-1111-1111-111111111111 purge_type=permanentlyDelete purge_areas=mailboxes

Context Example

{
    "MsGraph": {
        "eDiscoveryCase": {
            "Purge": {
                "OperationID": "example-operation-id",
                "Status": "succeeded"
            }
        }
    }
}

Human Readable Output

eDiscovery purge status is succeeded.

  • Operation ID: example-operation-id

msg-delete-ediscovery-search

Delete an eDiscoverySearch object.

Base Command

msg-delete-ediscovery-search

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
search_id The ID of the eDiscovery search. Optional

Context Output

There is no context output for this command.

Command example

!msg-delete-ediscovery-search case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 search_id=e7282eff-ba81-43cb-9027-522a343f6692

Human Readable Output

eDiscovery search e7282eff-ba81-43cb-9027-522a343f6692 was deleted successfully.

Threat Assessment Commands

msg-create-mail-assessment-request

Create and retrieve a mail threat assessment.

Note:

  • The message given in the command’s argument message_id has to contain X-MS-Exchange-Organization-Network-Message-Id header in the message or in the X-MS-Office365-Filtering-Correlation-Id header in quarantined messages.

  • Delegated Mail permissions (Mail.Read or Mail.Read.Shared) are required to access the mail received by the user (recipient email and message user), which means that if the authenticated user is different from the user specified in the recipient_email and message_user, then Read and manage permissions on behalf of the given user need to be added for the authenticated user via Microsoft 365 admin center.

    • Go to Microsoft 365 admin center.
    • Choose the user email which will be provided in the command’s arguments.
    • Click on Manage product licenses.
    • Go to Mail.
    • Under Mailbox permissions, click on Read and manage permissions.
    • click on Add permissions.
    • Choose the authenticated user email from the list of given users.
    • Click on add.

Base Command

msg-create-mail-assessment-request

Input

Argument Name Description Required
recipient_email The email of the user who recieved the mail. Required
expected_assessment the expected assessment: blocked or unblocked Required
category The category of the threat: phishing, malware or spam. Required
message_user Message user, the user’s id or the user’s email. Required
message_id Message id, Message has to contain ‘X-MS-Exchange-Organization-Network-Message-Id’ header in the message or the ‘X-MS-Office365-Filtering-Correlation-Id’ header in quarantined messages. Required

Context Output

Path Type Description
MSGraphMail.MailAssessment.ID String Request id.
MSGraphMail.MailAssessment.CreatedDateTime Date Created data of the threat assessment request.
MSGraphMail.MailAssessment.ContentType String The content type of threat assessment.
MSGraphMail.MailAssessment.ExpectedAssessment String The expected assessment from submitter. Possible values are: block, unblock.
MSGraphMail.MailAssessment.Category String The threat category. Possible values are: spam, phishing, malware.
MSGraphMail.MailAssessment.Status String The assessment process status. Possible values are: pending, completed.
MSGraphMail.MailAssessment.RequestSource String The source of threat assessment request. Possible values are: administrator.
MSGraphMail.MailAssessment.RecipientEmail String The mail recipient whose policies are used to assess the mail.
MSGraphMail.MailAssessment.DestinationRoutingReason String The reason for mail routed to its destination. Possible values are: none, mailFlowRule, safeSender, blockedSender, advancedSpamFiltering, domainAllowList, domainBlockList, notInAddressBook, firstTimeSender, autoPurgeToInbox, autoPurgeToJunk, autoPurgeToDeleted, outbound, notJunk, junk.
MSGraphMail.MailAssessment.MessageID String Extracted from the message URI which is The resource URI of the mail message for assessment.
MSGraphMail.MailAssessment.CreatedUserID String User id.
MSGraphMail.MailAssessment.CreatedUsername String Username.
MSGraphMail.MailAssessment.ResultType String Result of the request.
MSGraphMail.MailAssessment.ResultMessage String Message of the result.

Command example

!msg-create-mail-assessment-request recipient_email="avishai@demistodev.onmicrosoft.com" expectedAssessment=unblock category=spam user_id=3fa9f28b-eb0e-463a-ba7b-8089fe9991e2 user_message=AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NmZhLWQ5MGY1YjIyNzBkNABGAAAAAACYCKjWAnXBTrnhgWJCcLX7BwDrxRwRjq-zTrN6vWSzK4OWAAAAAAEJAADrxRwRjq-zTrN6vWSzK4OWAAY5aBb-AAA=

Context Example

{

    "id": "11922306-b25b-4605-ff0d-08d772fcf996",
    "createdDateTime": "2019-11-27T05:45:14.0962061Z",
    "contentType": "mail",
    "expectedAssessment": "unblock",
    "category": "spam",
    "status": "completed",
    "requestSource": "administrator",
    "recipientEmail": "avishai@demistodev.onmicrosoft.com",
    "destinationRoutingReason": "notJunk",
    "messageUri": "",
    "createdBy": {
      "user": {
        "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
        "displayName": "Ronald Admin"
      }
    },
    "results": [
        {
            "id": "63798129-a62c-4f9e-2c6d-08d772fcfb0e",
            "createdDateTime": "2019-11-27T05:45:16.55Z",
            "resultType": "checkPolicy",
            "message": "No policy was hit."
        },
        {
            "id": "d38c2448-79eb-467e-2495-08d772fdb7d1",
            "createdDateTime": "2019-11-27T05:50:33.243Z",
            "resultType": "rescan",
            "message": "Not Spam"
        }
    ]
}

Human Readable Output

Mail assessment request

ID Created DateTime Content Type Expected Assessment Category Status Request Source Recipient Email Destination Routing Reason Created User ID Created Username
11922306-b25b-4605-ff0d-08d772fcf996 “2019-11-27T05:45:14.0962061Z” mail unblock spam completed administrator avishai@demistodev.onmicrosoft.com notJunk 63798129-a62c-4f9e-2c6d-08d772fcfb0e No policy was hit.

msg-create-email-file-assessment-request

Create and retrieve an email file threat assessment.

Note: File has to contain X-MS-Exchange-Organization-Network-Message-Id header in the message or in the X-MS-Office365-Filtering-Correlation-Id header in quarantined messages.

Base Command

msg-create-email-file-assessment-request

Input

Argument Name Description Required
recipient_email The email of the user who recieved the mail. Required
expected_assessment the expected assessment: blocked or unblocked Required
category The category of the threat: phishing, malware or spam. Required
content_data content of an email file. Optional
entry_id entry id of file uploaded in the war room. Optional

Context Output

Path Type Description
MSGraphMail.EmailAssessment.ID String Request id.
MSGraphMail.EmailAssessment.CreatedDateTime Date Created data of the threat assessment request.
MSGraphMail.EmailAssessment.ContentType String The content type of threat assessment.
MSGraphMail.EmailAssessment.ExpectedAssessment String The expected assessment from submitter. Possible values are: block, unblock.
MSGraphMail.EmailAssessment.Category String The threat category. Possible values are: spam, phishing, malware.
MSGraphMail.EmailAssessment.Status String The assessment process status. Possible values are: pending, completed.
MSGraphMail.EmailAssessment.RequestSource String The source of threat assessment request. Possible values are: administrator.
MSGraphMail.EmailAssessment.RecipientEmail String The mail recipient whose policies are used to assess the mail.
MSGraphMail.EmailAssessment.DestinationRoutingReason String The reason for mail routed to its destination. Possible values are: none, mailFlowRule, safeSender, blockedSender, advancedSpamFiltering, domainAllowList, domainBlockList, notInAddressBook, firstTimeSender, autoPurgeToInbox, autoPurgeToJunk, autoPurgeToDeleted, outbound, notJunk, junk.
MSGraphMail.EmailAssessment.CreatedUserID String User id.
MSGraphMail.EmailAssessment.CreatedUsername String Username.
MSGraphMail.EmailAssessment.ResultType String Result of the request.
MSGraphMail.EmailAssessment.ResultMessage String Message of the result.

Command example

!msg-create-email-file-assessment-request recipient_email="avishai@demistodev.onmicrosoft.com" expectedAssessment=unblock category=phishing entry_id=12359704829584

Context Example

{

    "id": "76598306-b25b-4605-ff0d-03kgmtfcf996",
    "createdDateTime": "2019-11-27T05:45:14.0962061Z",
    "contentType": "mail",
    "expectedAssessment": "unblock",
    "category": "phishing",
    "status": "completed",
    "requestSource": "administrator",
    "recipientEmail": "avishai@demistodev.onmicrosoft.com",
    "destinationRoutingReason": "notJunk",
    "createdBy": {
      "user": {
        "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
        "displayName": "Ronald Admin"
      }
    },
    "results": [
        {
            "id": "63798129-a62c-4f9e-2c6d-08d772fcfb0e",
            "createdDateTime": "2019-11-27T05:45:16.55Z",
            "resultType": "checkPolicy",
            "message": "Phishing attempt."
        }
    ]
}

Human Readable Output

Mail assessment request

ID Created DateTime Content Type Expected Assessment Category Status Request Source Recipient Email Destination Routing Reason Created User ID Created Username
76598306-b25b-4605-ff0d-03kgmtfcf996 “2019-11-27T05:45:14.0962061Z” mail unblock phishing completed administrator avishai@demistodev.onmicrosoft.com notJunk 63798129-a62c-4f9e-2c6d-08d772fcfb0e Phishing attempt.

msg-create-file-assessment-request

Create and retrieve a file threat assessment.

Base Command

msg-create-file-assessment-request

Input

Argument Name Description Required
file_name The file name. Required
expected_assessment the expected assessment: blocked or unblocked Required
category The category of the threat: phishing, malware or spam. Required
content_data content of an email file. Optional
entry_id entry id of file uploaded in the war room. Optional

Context Output

Path Type Description
MSGraphMail.FileAssessment.ID String Request id.
MSGraphMail.FileAssessment.CreatedDateTime Date Created data of the threat assessment request.
MSGraphMail.FileAssessment.ContentType String The content type of threat assessment.
MSGraphMail.FileAssessment.ExpectedAssessment String The expected assessment from submitter. Possible values are: block, unblock.
MSGraphMail.FileAssessment.Category String The threat category. Possible values are: phishing, malware.
MSGraphMail.FileAssessment.Status String The assessment process status. Possible values are: pending, completed.
MSGraphMail.FileAssessment.RequestSource String The source of threat assessment request. Possible values are: administrator.
MSGraphMail.FileAssessment.FileName String The file name.
MSGraphMail.FileAssessment.CreatedUserID String User id.
MSGraphMail.FileAssessment.CreatedUsername String Username.
MSGraphMail.FileAssessment.ResultType String Result of the request.
MSGraphMail.FileAssessment.ResultMessage String Message of the result.

Command example

!msg-create-file-assessment-request file_name="test_file.txt" expectedAssessment=block category=phishing entry_id=1235970482958bkf4

Context Example

{

    "id": "0796306-b456-4605-ff0d-03kgmtfcf876",
    "createdDateTime": "2019-11-27T05:45:14.0962061Z",
    "contentType": "file",
    "expectedAssessment": "block",
    "category": "phishing",
    "status": "completed",
    "requestSource": "administrator",
    "fileName": "test_file.txt",
    "createdBy": {
      "user": {
        "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
        "displayName": "Ronald Admin"
      }
    },
    "results": [
        {
            "id": "63798129-a62c-4f9e-2c6d-08d772fcfb0e",
            "createdDateTime": "2019-11-27T05:45:16.55Z",
            "resultType": "checkPolicy",
            "message": "Phishing attempt."
        }
    ]
}

Human Readable Output

Mail assessment request

ID Created DateTime Content Type Expected Assessment Category Status Request Source File Name Created User ID Created Username
0796306-b456-4605-ff0d-03kgmtfcf876 “2019-11-27T05:45:14.0962061Z” file block phishing completed administrator test_file.txt 63798129-a62c-4f9e-2c6d-08d772fcfb0e Phishing attempt.

msg-create-url-assessment-request

Create and retrieve url threat assessment.

Base Command

msg-create-url-assessment-request

Input

Argument Name Description Required
url The URL. Required
expected_assessment the expected assessment: blocked or unblocked Required
category The category of the threat: phishing, malware or spam. Required

Context Output

Path Type Description
MSGraphMail.UrlAssessment.ID String Request id.
MSGraphMail.UrlAssessment.CreatedDateTime Date Created data of the threat assessment request.
MSGraphMail.UrlAssessment.ContentType String The content type of threat assessment.
MSGraphMail.UrlAssessment.ExpectedAssessment String The expected assessment from submitter. Possible values are: block, unblock.
MSGraphMail.UrlAssessment.Category String The threat category. Possible values are: spam, phishing, malware.
MSGraphMail.UrlAssessment.Status String The assessment process status. Possible values are: pending, completed.
MSGraphMail.UrlAssessment.RequestSource String The source of threat assessment request. Possible values are: administrator.
MSGraphMail.UrlAssessment.Url String The url.
MSGraphMail.UrlAssessment.CreatedUserID String User id.
MSGraphMail.UrlAssessment.CreatedUsername String Username.
MSGraphMail.UrlAssessment.ResultType String Result of the request.
MSGraphMail.UrlAssessment.ResultMessage String Message of the result.
MSGraphMail.UrlAssessment.RecipientEmail String Recipient Email.
MSGraphMail.UrlAssessment.DestinationRoutingReason String Destination Routing Reason.

Command example

!msg-create-url-assessment-request url="httpp://support.clean-mx.de/clean-mx/viruses.php" expectedAssessment=block category=malware

Context Example

{

    "id": "0796306-b456-4605-ff0d-03okmtgcf876",
    "createdDateTime": "2019-11-27T05:45:14.0962061Z",
    "contentType": "url",
    "expectedAssessment": "block",
    "category": "malware",
    "status": "completed",
    "requestSource": "administrator",
    "url": "httpp://support.clean-mx.de/clean-mx/viruses.php",
    "createdBy": {
      "user": {
        "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
        "displayName": "Ronald Admin"
      }
    },
    "results": [
        {
            "id": "63798129-a62c-4f9e-2c6d-08d772fcfb0e",
            "createdDateTime": "2019-11-27T05:45:16.55Z",
            "resultType": "checkPolicy",
            "message": "Malware attempt."
        }
    ]
}

Human Readable Output

Mail assessment request

ID Created DateTime Content Type Expected Assessment Category Status Request Source URL Created User ID Created Username
0796306-b456-4605-ff0d-03okmtgcf876 “2019-11-27T05:45:14.0962061Z” url block malware completed administrator httpp://support.clean-mx.de/clean-mx/viruses.php 63798129-a62c-4f9e-2c6d-08d772fcfb0e Malware attempt.

msg-list-threat-assessment-requests

Retrieve all threat assessment requests.

Base Command

msg-list-threat-assessment-requests

Input

Argument Name Description Required
request_id The request id. Optional
filter Available fields for filter are:expectedAssessment,ContentType,status,requestSource. Example:category eq ‘malware’ Optional
order_by Drop -down: id, createdDateTime, ContentType, expectedAssessment, category, status, requestSource, category Optional
sort_order desc or asc. Optional
limit Default is 50. Optional
next_token the retrieved token from first run when there’s more data to retrieve. Optional

Context Output

Path Type Description
MSGraphMail.AssessmentRequest.ID String Request id.
MSGraphMail.AssessmentRequest.CreatedDateTime Date Created data of the threat assessment request.
MSGraphMail.AssessmentRequest.ContentType String The content type of threat assessment.
MSGraphMail.AssessmentRequest.ExpectedAssessment String The expected assessment from submitter. Possible values are: block, unblock.
MSGraphMail.AssessmentRequest.Category String The threat category. Possible values are: spam, phishing, malware.
MSGraphMail.AssessmentRequest.Status String The assessment process status. Possible values are: pending, completed.
MSGraphMail.AssessmentRequest.RequestSource String The source of threat assessment request. Possible values are: administrator.
MSGraphMail.AssessmentRequest.DestinationRoutingReason String The destination Routing Reason.
MSGraphMail.AssessmentRequest.RecipientEmail String The recipient email.
MSGraphMail.AssessmentRequest.URL String The url.
MSGraphMail.AssessmentRequest.FileName String The file name.
MSGraphMail.AssessmentRequest.CreatedUserID String User id.
MSGraphMail.AssessmentRequest.CreatedUsername String Username.
MSGraphMail.AssessmentRequest.ResultType String Result of the request.
MSGraphMail.AssessmentRequest.ResultMessage String Message of the result.
MsGraph.AssessmentRequestNextToken.next_token String the next token from the previous run.

Command example


#### Context Example

```json
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#informationProtection/threatAssessmentRequests",
  "@odata.nextLink": "https://graph.microsoft.com/v1.0/informationProtection/threatAssessmentRequests?$skiptoken=eyJQYWdlQ29va2llIjoiPHJvdyBpZF9JZGVudGl0",
  "value": [
    {
      "@odata.type": "#microsoft.graph.mailAssessmentRequest",
      "id": "49c5ef5b-1f65-444a-e6b9-08d772ea2059",
      "createdDateTime": "2019-11-27T03:30:18.6890937Z",
      "contentType": "mail",
      "expectedAssessment": "block",
      "category": "spam",
      "status": "pending",
      "requestSource": "administrator",
      "recipientEmail": "avishaibrandies@microsoft.com",
      "destinationRoutingReason": "notJunk",
      "messageUri": "https://graph.microsoft.com/v1.0/users/c52ce8db-3e4b-4181-93c4-7d6b6bffaf60/messages/AAMkADU3MWUxOTU0LWNlOTEt=",
      "createdBy": {
        "user": {
          "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
          "displayName": "Ronald Admin"
        }
      }
    },
    {
      "@odata.type": "#microsoft.graph.emailFileAssessmentRequest",
      "id": "ab2ad9b3-2213-4091-ae0c-08d76ddbcacf",
      "createdDateTime": "2019-11-20T17:05:06.4088076Z",
      "contentType": "mail",
      "expectedAssessment": "block",
      "category": "malware",
      "status": "completed",
      "requestSource": "administrator",
      "recipientEmail": "tifc@a830edad9050849EQTPWBJZXODQ.onmicrosoft.com",
      "destinationRoutingReason": "notJunk",
      "contentData": "",
      "createdBy": {
        "user": {
          "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
          "displayName": "Ronald Admin"
        }
      }
    }
  ]
}

Human Readable Output

###Next Token is: eyJQYWdlQ29va2llIjoiPHJvdyBpZF9JZGVudGl

Mail assessment request

ID Created DateTime Content Type Expected Assessment Category Status Request Source Recipient Email Created User ID Created Username destinationRoutingReason
49c5ef5b-1f65-444a-e6b9-08d772ea2059 “2019-11-27T03:30:18.6890937Z” mail block spam pending administrator avishaibrandies@microsoft.com 63798129-a62c-4f9e-2c6d-08d772fcfb0e spam attempt. notJunk
ab2ad9b3-2213-4091-ae0c-08d76ddbcacf 2019-11-20T17:05:06.4088076Z mail block malware pending administrator avishaibrandies@microsoft.com 63798129-a62c-4f9e-2c6d-08d772fcfb0e Malware attempt. notJunk

msg-generate-login-url

Generate the login URL used for the authorization code flow.

Base Command

msg-generate-login-url

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Human Readable Output

Authorization instructions

  1. Click on the login URL to sign in and grant Cortex XSOAR permissions for your Azure Service Management.
    You will be automatically redirected to a link with the following structure:
    REDIRECT_URI?code=AUTH_CODE&session_state=SESSION_STATE
  2. Copy the AUTH_CODE (without the code= prefix, and the session_state parameter)
    and paste it in your instance configuration under the Authorization code parameter.

msg-advanced-hunting

Advanced hunting is a threat-hunting tool that uses specially constructed queries to examine the past 30 days of event data in Microsoft Graph Security.
To save result in context to ‘Microsoft365Defender’ as well, you can check the ‘Microsoft 365 Defender context’ checkbox in Instance Setting.

Base Command

msg-advanced-hunting

Input

Argument Name Description Required
query Advanced hunting query. Required
limit Number of entries. Enter -1 for unlimited query, In case a limit also appears in the query, priority will be given to the query. Optional
timeout The time limit in seconds for the http request to run Optional

Context Output

Path Type Description
MsGraph.Hunt.query String The query used, also acted as a key.
MsGraph.Hunt.results Unknown The results of the query.
Microsoft365Defender.Hunt.query String The query used, also acted as a key.
Microsoft365Defender.Hunt.results Unknown The results of the query.

Command example

!msg-advanced-hunting query=AlertInfo limit=1

Context Example

{
    "Microsoft365Defender": {
        "Hunt": {
            "query": "AlertInfo | limit 1 ",
            "results": [
                {
                    "AlertId": "abc123",
                    "AttackTechniques": "",
                    "Category": "Exfiltration",
                    "DetectionSource": "Microsoft Data Loss Prevention",
                    "ServiceSource": "Microsoft Data Loss Prevention",
                    "Severity": "Medium",
                    "Timestamp": "2024-03-19T03:00:08Z",
                    "Title": "DLP policy (Custom policy) matched for email with subject (Splunk Report: High Or Critical Priority Host With Malware - 15 min)"
                }
            ]
        }
    },
    "MsGraph": {
        "Hunt": {
            "query": "AlertInfo | limit 1 ",
            "results": [
                {
                    "AlertId": "abc123",
                    "AttackTechniques": "",
                    "Category": "Exfiltration",
                    "DetectionSource": "Microsoft Data Loss Prevention",
                    "ServiceSource": "Microsoft Data Loss Prevention",
                    "Severity": "Medium",
                    "Timestamp": "2024-03-19T03:00:08Z",
                    "Title": "DLP policy (Custom policy) matched for email with subject (Splunk Report: High Or Critical Priority Host With Malware - 15 min)"
                }
            ]
        }
    }
}

Human Readable Output

See Results Above

msg-list-security-incident

Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. If you want a specific incident, enter an incident ID.

Base Command

msg-list-security-incident

Input

Argument Name Description Required
incident_id Incident’s ID. Optional
limit Number of incidents in the list. Maximum is 50. Default is 50. Optional
timeout The time limit in seconds for the http request to run. Default is 50. Optional
status The status of the incident. Possible values are: active, redirected, resolved, inProgress, unknownFutureValue, awaitingAction. Optional
assigned_to Owner of the incident. Optional
severity Indicates the possible impact on assets. The higher the severity, the greater the impact. Typically higher severity items require the most immediate attention. Possible values are: unknown, informational, low, medium, high, unknownFutureValue. Optional
classification The specification for the incident. Optional
odata Filter incidents using ‘odata’ query. Optional
extra_data Whether to include each incident’s related alerts in the response. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
MsGraph.Incident.assignedTo string Owner of the incident, or null if no owner is assigned. Free editable text.
MsGraph.Incident.classification string The specification for the incident. Possible values are unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
MsGraph.Incident.comments string Array of comments created by the Security Operations (SecOps) team when the incident is managed.
MsGraph.Incident.createdDateTime date Time when the incident was first created.
MsGraph.Incident.customTags string Array of custom tags associated with an incident.
MsGraph.Incident.description string Description of the incident.
MsGraph.Incident.determination string Specifies the determination of the incident. Possible values are unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.
MsGraph.Incident.displayName string The incident name.
MsGraph.Incident.id number Unique identifier to represent the incident.
MsGraph.Incident.incidentWebUrl string The URL for the incident page in the Microsoft 365 Defender portal.
MsGraph.Incident.lastModifiedBy string The identity that last modified the incident.
MsGraph.Incident.lastUpdateDateTime string Time when the incident was last updated.
MsGraph.Incident.redirectIncidentId string Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected.
MsGraph.Incident.severity string Indicates the possible impact on assets. The higher the severity, the greater the impact. Typically higher severity items require the most immediate attention. Possible values are unknown, informational, low, medium, high, unknownFutureValue.
MsGraph.Incident.status string The status of the incident. Possible values are active, resolved, inProgress, redirected, unknownFutureValue, and awaitingAction.
MsGraph.Incident.tenantId string The Microsoft Entra tenant in which the alert was created.
MsGraph.Incident.systemTags string The system tags associated with the incident.

Command example

!msg-list-security-incident limit=1

Context Example

{
    "MsGraph": {
        "Incident": {
            "@odata.count": 26176,
            "value": [
                {
                    "Assigned to": null,
                    "Classification": "unknown",
                    "Created date time": "2024-03-19T08:08:33.2533333Z",
                    "Custom tags": "",
                    "Determination": "unknown",
                    "Display name": "DLP policy (Custom policy) matched for email with subject (Splunk Report: High Or Critical Priority Host With Malware - 15 min) involving one user",
                    "Severity": "medium",
                    "Status": "active",
                    "System tags": "",
                    "Updated date time": "2024-03-19T08:08:33.36Z",
                    "id": "12345"
                }
            ]
        }
    }
}

Human Readable Output

Incidents

Display name id Severity Status Assigned to Custom tags System tags Classification Determination Created date time Updated date time
DLP policy (Custom policy) matched for email with subject (Splunk Report: High Or Critical Priority Host With Malware - 15 min) involving one user 12345 medium active       unknown unknown 2024-03-19T08:08:33.2533333Z 2024-03-19T08:08:33.36Z

msg-update-security-incident

Update the incident with the given ID.

Base Command

msg-update-security-incident

Input

Argument Name Description Required
incident_id Incident’s ID. Required
status Categorize incidents (as Active, Resolved, or Redirected). Possible values are: active, resolved, redirected, unknownFutureValue. Optional
assigned_to Owner of the incident. Optional
determination Determination of the incident. Possible values are: unknown, apt, malware, securityPersonnel, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, notMalicious. Optional
classification The specification for the incident. Possible values are: unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue. Optional
severity Indicates the possible impact on assets. The higher the severity, the bigger the impact. Typically, higher severity items require the most immediate attention. The possible values are: unknown, informational, low, medium, high, unknownFutureValue. Optional
resolving_comment User input that explains the resolution of the incident and the classification choice. It contains free editable text. Optional
custom_tags Array of custom tags associated with an incident. Optional
timeout The time limit in seconds for the http request to run. Default is 50. Optional

Context Output

Path Type Description
MsGraph.Incident.assignedTo String Owner of the incident, or null if no owner is assigned. Free editable text.
MsGraph.Incident.classification String The specification for the incident. Possible values are unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
MsGraph.Incident.comments String Array of comments created by the Security Operations (SecOps) team when the incident is managed.
MsGraph.Incident.createdDateTime Date Time when the incident was first created.
MsGraph.Incident.customTags String Array of custom tags associated with an incident.
MsGraph.Incident.description String Description of the incident.
MsGraph.Incident.determination String Specifies the determination of the incident. Possible values are unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.
MsGraph.Incident.displayName String The incident name.
MsGraph.Incident.id String Unique identifier to represent the incident.
MsGraph.Incident.incidentWebUrl String The URL for the incident page in the Microsoft 365 Defender portal.
MsGraph.Incident.lastModifiedBy String The identity that last modified the incident.
MsGraph.Incident.lastUpdateDateTime Date Time when the incident was last updated.
MsGraph.Incident.redirectIncidentId String Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected.
MsGraph.Incident.severity String Indicates the possible impact on assets. The higher the severity, the greater the impact. Typically higher severity items require the most immediate attention. Possible values are unknown, informational, low, medium, high, unknownFutureValue.
MsGraph.Incident.status String The status of the incident. Possible values are active, resolved, inProgress, redirected, unknownFutureValue, and awaitingAction.
MsGraph.Incident.tenantId String The Microsoft Entra tenant in which the alert was created.
MsGraph.Incident.systemTags String collection The system tags associated with the incident.

Command example

!msg-update-security-incident incident_id=12345

Context Example

{
    "MsGraph": {
        "Incidents": {
            "assignedTo": "test5",
            "classification": "unknown",
            "comments": [],
            "createdDateTime": "2024-03-17T15:50:31.9033333Z",
            "customTags": [],
            "description": null,
            "determination": "unknown",
            "displayName": "Exfiltration incident involving one user",
            "id": "12345",
            "incidentWebUrl": "https://security.microsoft.com/incidents/12345?tid=abc123",
            "lastModifiedBy": "Microsoft 365 Defender-AlertCorrelation",
            "lastUpdateDateTime": "2024-03-19T07:24:34.7066667Z",
            "redirectIncidentId": null,
            "severity": "medium",
            "status": "active",
            "systemTags": [],
            "tenantId": "abc123"
        }
    }
}

Human Readable Output

Updated incident No. 12345

Display name id Severity Status Assigned to Custom tags System tags Classification Determination Created date time Updated date time
Exfiltration incident involving one user 12345 medium active test5     unknown unknown 2024-03-17T15:50:31.9033333Z 2024-03-19T07:24:34.7066667Z

msg-run-estimate-statistics

Starts an eDiscovery estimate statistics operation in Microsoft Purview. The operation calculates the size and number of items matching the search query.

Base Command

msg-run-estimate-statistics

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
search_id The ID of the eDiscovery search. Required
statistics_options Bitwise options that specify the statistics to generate. The possible values are: includeRefiners, includeQueryStats, includeUnindexedStats, advancedIndexing, locationsWithoutHits. The advancedIndexing and locationsWithoutHits values are only considered if includeUnindexedStats is set. Possible values are: includeRefiners, includeQueryStats, includeUnindexedStats, advancedIndexing, locationsWithoutHits. Optional

Context Output

There is no context output for this command.

msg-get-last-estimate-statistics-operation

Retrieves the most recent eDiscovery estimate statistics operation for a given search in Microsoft Purview. Use this command after running ‘msg-run-estimate-statistics’ to check the results.

Base Command

msg-get-last-estimate-statistics-operation

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
search_id The ID of the eDiscovery search. Required

Context Output

Path Type Description
MsGraph.eDiscovery.EstimateStatistics.CaseID String The ID of the eDiscovery case.
MsGraph.eDiscovery.EstimateStatistics.SearchID String The ID of the eDiscovery search.
MsGraph.eDiscovery.EstimateStatistics.OperationID String The ID of the last estimate statistics operation.
MsGraph.eDiscovery.EstimateStatistics.Status String The current status of the last estimate statistics operation (e.g., running, succeeded, failed).
MsGraph.eDiscovery.EstimateStatistics.PercentProgress Number The percent progress of the last estimate statistics operation.
MsGraph.eDiscovery.EstimateStatistics.CreatedDateTime Date The date and time when the estimate operation was created.
MsGraph.eDiscovery.EstimateStatistics.CompletedDateTime Date The date and time when the estimate operation completed.
MsGraph.eDiscovery.EstimateStatistics.IndexedItemsCount Number The number of indexed items found in the search.
MsGraph.eDiscovery.EstimateStatistics.IndexedItemsSize Number The total size (in bytes) of indexed items.
MsGraph.eDiscovery.EstimateStatistics.UnindexedItemsCount Number The number of unindexed items found in the search.
MsGraph.eDiscovery.EstimateStatistics.UnindexedItemsSize Number The total size (in bytes) of unindexed items.
MsGraph.eDiscovery.EstimateStatistics.TotalItemsCount Number The total number of items (indexed + unindexed).
MsGraph.eDiscovery.EstimateStatistics.TotalItemsSize Number The total size (in bytes) of all items (indexed + unindexed).

msg-list-ediscovery-case-hold-policy

Get a list of the ediscoveryHoldPolicy objects and their properties.

Base Command

msg-list-ediscovery-case-hold-policy

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
hold_policy_id The ID of the legal hold policy. Optional
limit Number of total results to return. Default is 50. Optional
all_results Show all results if true. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
MsGraph.eDiscoveryCase.HoldPolicy.ID String The ID of the eDiscovery hold policy.
MsGraph.eDiscoveryCase.HoldPolicy.DisplayName String The display name of the legal hold.
MsGraph.eDiscoveryCase.HoldPolicy.Description String The legal hold description.
MsGraph.eDiscoveryCase.HoldPolicy.ContentQuery String KQL query that specifies content to be held. If empty, all content in the specified locations is held.
MsGraph.eDiscoveryCase.HoldPolicy.IsEnabled Boolean Indicates whether the hold is enabled and actively holding content.
MsGraph.eDiscoveryCase.HoldPolicy.Status String The status of the legal hold. Possible values are Pending, Error, Success.
MsGraph.eDiscoveryCase.HoldPolicy.Errors String Lists any errors that happened while placing the hold.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedDateTime Date The date and time the legal hold was created.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedDateTime Date The date and time the legal hold was last modified.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.ID String The unique identifier of the application associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.DisplayName String The display name of the application associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.TenantId String The tenant ID of the application identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.ID String The unique identifier of the application instance associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.DisplayName String The display name of the application instance associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.TenantId String The tenant ID of the application instance identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.ID String The unique identifier of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.DisplayName String The display name of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.TenantId String The tenant ID of the conversation identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.ID String The identifier describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.DisplayName String The display name describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.TenantId String The tenant ID of the conversation identity type.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.ID String The unique identifier of the device associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.DisplayName String The display name of the device associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.TenantId String The tenant ID of the device identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.ID String The unique identifier of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.DisplayName String The display name of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.TenantId String The tenant ID of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.ID String The unique identifier of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.DisplayName String The display name of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.TenantId String The tenant ID of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.ID String The unique identifier of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.DisplayName String The display name of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.TenantId String The tenant ID of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.ID String The unique identifier of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.DisplayName String The display name of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.TenantId String The tenant ID of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.ID String The unique identifier of the user associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.DisplayName String The display name of the user associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.TenantId String The tenant ID of the user identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.ID String The unique identifier of the application associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.DisplayName String The display name of the application associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.TenantId String The tenant ID of the application identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.ID String The unique identifier of the application instance associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.DisplayName String The display name of the application instance associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.TenantId String The tenant ID of the application instance identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.ID String The unique identifier of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.DisplayName String The display name of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.TenantId String The tenant ID of the conversation identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.ID String The identifier describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.DisplayName String The display name describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.TenantId String The tenant ID of the conversation identity type.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.ID String The unique identifier of the device associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.DisplayName String The display name of the device associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.TenantId String The tenant ID of the device identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.ID String The unique identifier of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.DisplayName String The display name of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.TenantId String The tenant ID of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.ID String The unique identifier of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.DisplayName String The display name of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.TenantId String The tenant ID of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.ID String The unique identifier of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.DisplayName String The display name of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.TenantId String The tenant ID of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.ID String The unique identifier of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.DisplayName String The display name of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.TenantId String The tenant ID of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.ID String The unique identifier of the user associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.DisplayName String The display name of the user associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.TenantId String The tenant ID of the user identity associated with this action.

msg-export-result-ediscovery-data

Export results from an estimated ediscoverySearch. For details, see Manage a collection estimate (https://learn.microsoft.com/en-us/purview/ediscovery-create-draft-collection#manage-a-collection-estimate).

Base Command

msg-export-result-ediscovery-data

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
search_id The ID of the search. Required
additional_options The additional options for the export. Possible values are: none, teamsAndYammerConversations, cloudAttachments, allDocumentVersions, subfolderContents, listAttachments, htmlTranscripts, advancedIndexing, allItemsInFolder, includeFolderAndPath, condensePaths, friendlyName, splitSource, includeReport. Required
export_criteria The portion of the estimate results to be exported. Possible values are: searchHits, partiallyIndexed. Required
export_format The desired format of the exported emails. Possible values are: pst, msg. Required
cloud_attachment_version The versions of cloud attachments to include in messages. Possible values are: latest, recent10, recent100, all. Default is latest. Optional
description The description of the export result. Optional
display_name The display name of the export result. Required
document_version The versions of files in SharePoint to include. Possible values are: latest, recent10, recent100, all. Default is latest. Optional
export_location Location scope for partially indexed items. You can choose to include partially indexed items only in responsive locations with search hits or in all targeted locations. Possible values are: responsiveLocations, nonresponsiveLocations. Optional

Context Output

Path Type Description
MsGraph.eDiscoveryCase.Export.OperationID String The ID of the export operation. Use this ID to retrieve the operation status via ‘msg-list-case-operation’.
MsGraph.eDiscoveryCase.Export.CaseID String The ID of the eDiscovery case the export belongs to.
MsGraph.eDiscoveryCase.Export.Location String The Location header URL returned for the export operation.

Command example

!msg-export-result-ediscovery-data case_id=00000000-0000-0000-0000-000000000000 search_id=11111111-1111-1111-1111-111111111111 additional_options=none export_criteria=searchHits export_format=pst display_name="Example Export"

Context Example

{
    "MsGraph": {
        "eDiscoveryCase": {
            "Export": {
                "CaseID": "00000000-0000-0000-0000-000000000000",
                "Location": "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/00000000-0000-0000-0000-000000000000/operations/example-operation-id",
                "OperationID": "example-operation-id"
            }
        }
    }
}

Human Readable Output

eDiscovery export request was submitted successfully.

  • Case ID: 00000000-0000-0000-0000-000000000000
  • Operation ID: example-operation-id

msg-delete-ediscovery-case-hold-policy

Delete an eDiscovery hold policy. This command submits a deletion request to Microsoft Graph; the policy may not be removed immediately and can take some time to complete.

Base Command

msg-delete-ediscovery-case-hold-policy

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
hold_policy_id The policy ID that is intended to be deleted. Required

Context Output

There is no context output for this command.

msg-list-case-operation

Get a list of the caseOperation objects and their properties, or retrieve a specific operation by ID. When operation_id is provided, you can set download_file=true to download the export report (if available).

Base Command

msg-list-case-operation

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
operation_id The ID of the operation. Optional
limit Number of total results to return. Default is 50. Optional
all_results Show all results if true. Possible values are: true, false. Default is false. Optional
download_file Download the export report when an export file link is available. This only applies if operation_id is provided. For authorization or permission errors while downloading, see: https://learn.microsoft.com/en-us/graph/api/security-caseoperation-get?view=graph-rest-1.0&tabs=http#response-1. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
MsGraph.eDiscoveryCase.Operation.ID String The ID of the case operation. Read-only.
MsGraph.eDiscoveryCase.Operation.Action String The type of action the operation represents (caseAction). Example values: contentExport, applyTags, convertToPdf, index, estimateStatistics, addToReviewSet, holdUpdate, purgeData, exportReport, exportResult, holdPolicySync.
MsGraph.eDiscoveryCase.Operation.Status String The status of the case operation. Possible values: notStarted, submissionFailed, running, succeeded, partiallySucceeded, failed.
MsGraph.eDiscoveryCase.Operation.PercentProgress Number The progress of the operation.
MsGraph.eDiscoveryCase.Operation.CreatedDateTime Date The date and time the operation was created.
MsGraph.eDiscoveryCase.Operation.CompletedDateTime Date The date and time the operation was completed.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Application.ID String The unique identifier of the application associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Application.DisplayName String The display name of the application associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Application.TenantId String The tenant ID of the application identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.ApplicationInstance.ID String The unique identifier of the application instance associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.ApplicationInstance.DisplayName String The display name of the application instance associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.ApplicationInstance.TenantId String The tenant ID of the application instance identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Conversation.ID String The unique identifier of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Conversation.DisplayName String The display name of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Conversation.TenantId String The tenant ID of the conversation identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.ConversationIdentityType.ID String The identifier describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.Operation.CreatedBy.ConversationIdentityType.DisplayName String The display name describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.Operation.CreatedBy.ConversationIdentityType.TenantId String The tenant ID of the conversation identity type.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Device.ID String The unique identifier of the device associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Device.DisplayName String The display name of the device associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Device.TenantId String The tenant ID of the device identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Encrypted.ID String The unique identifier of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Encrypted.DisplayName String The display name of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Encrypted.TenantId String The tenant ID of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.OnPremises.ID String The unique identifier of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.OnPremises.DisplayName String The display name of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.OnPremises.TenantId String The tenant ID of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Guest.ID String The unique identifier of the guest identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Guest.DisplayName String The display name of the guest identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Guest.TenantId String The tenant ID of the guest identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Phone.ID String The unique identifier of the phone identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Phone.DisplayName String The display name of the phone identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.Phone.TenantId String The tenant ID of the phone identity associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.User.ID String The unique identifier of the user associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.User.DisplayName String The display name of the user associated with this action.
MsGraph.eDiscoveryCase.Operation.CreatedBy.User.TenantId String The tenant ID of the user identity associated with this action.
MsGraph.eDiscoveryCase.Operation.ResultInfo.Code Number The result code (2xx success, 4xx client error, 5xx server error).
MsGraph.eDiscoveryCase.Operation.ResultInfo.Message String The result message.
MsGraph.eDiscoveryCase.Operation.ResultInfo.Subcode Number The result subcode.
File.Size Number The size of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.Name String The name of the file.
File.SSDeep String The SSDeep hash of the file.
File.EntryID String The entry ID of the file.
File.Info String File information.
File.Type String The file type.
File.MD5 String The MD5 hash of the file.
File.Extension String The file extension.

msg-create-ediscovery-case-hold-policy

Create a new ediscoveryHoldPolicy object.

Base Command

msg-create-ediscovery-case-hold-policy

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
display_name The display name of the legal hold policy. Required
description The description of the legal hold policy. Optional
content_query KQL query specifying content to be held in the specified locations. Learn about KQL (https://learn.microsoft.com/en-us/kusto/query/?view=azure-data-explorer&preserve-view=true). Optional

Context Output

Path Type Description
MsGraph.eDiscoveryCase.HoldPolicy.ID String The ID of the eDiscovery hold policy.
MsGraph.eDiscoveryCase.HoldPolicy.DisplayName String The display name of the legal hold.
MsGraph.eDiscoveryCase.HoldPolicy.Description String The legal hold description.
MsGraph.eDiscoveryCase.HoldPolicy.ContentQuery String KQL query that specifies content to be held. If empty, all content in the specified locations is held.
MsGraph.eDiscoveryCase.HoldPolicy.IsEnabled Boolean Indicates whether the hold is enabled and actively holding content.
MsGraph.eDiscoveryCase.HoldPolicy.Status String The status of the legal hold. Possible values are Pending, Error, Success.
MsGraph.eDiscoveryCase.HoldPolicy.Errors String Lists any errors that happened while placing the hold.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedDateTime Date The date and time the legal hold was created.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedDateTime Date The date and time the legal hold was last modified.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.ID String The unique identifier of the application associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.DisplayName String The display name of the application associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.TenantId String The tenant ID of the application identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.ID String The unique identifier of the application instance associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.DisplayName String The display name of the application instance associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.TenantId String The tenant ID of the application instance identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.ID String The unique identifier of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.DisplayName String The display name of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.TenantId String The tenant ID of the conversation identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.ID String The identifier describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.DisplayName String The display name describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.TenantId String The tenant ID of the conversation identity type.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.ID String The unique identifier of the device associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.DisplayName String The display name of the device associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.TenantId String The tenant ID of the device identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.ID String The unique identifier of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.DisplayName String The display name of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.TenantId String The tenant ID of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.ID String The unique identifier of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.DisplayName String The display name of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.TenantId String The tenant ID of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.ID String The unique identifier of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.DisplayName String The display name of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.TenantId String The tenant ID of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.ID String The unique identifier of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.DisplayName String The display name of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.TenantId String The tenant ID of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.ID String The unique identifier of the user associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.DisplayName String The display name of the user associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.TenantId String The tenant ID of the user identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.ID String The unique identifier of the application associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.DisplayName String The display name of the application associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.TenantId String The tenant ID of the application identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.ID String The unique identifier of the application instance associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.DisplayName String The display name of the application instance associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.TenantId String The tenant ID of the application instance identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.ID String The unique identifier of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.DisplayName String The display name of the conversation (team or channel) associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.TenantId String The tenant ID of the conversation identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.ID String The identifier describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.DisplayName String The display name describing whether the conversation identifies a team or channel.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.TenantId String The tenant ID of the conversation identity type.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.ID String The unique identifier of the device associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.DisplayName String The display name of the device associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.TenantId String The tenant ID of the device identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.ID String The unique identifier of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.DisplayName String The display name of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.TenantId String The tenant ID of the encrypted identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.ID String The unique identifier of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.DisplayName String The display name of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.TenantId String The tenant ID of the on-premises identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.ID String The unique identifier of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.DisplayName String The display name of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.TenantId String The tenant ID of the guest identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.ID String The unique identifier of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.DisplayName String The display name of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.TenantId String The tenant ID of the phone identity associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.ID String The unique identifier of the user associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.DisplayName String The display name of the user associated with this action.
MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.TenantId String The tenant ID of the user identity associated with this action.

msg-update-ediscovery-case-hold-policy

Update the properties of an ediscoveryHoldPolicy object.

Base Command

msg-update-ediscovery-case-hold-policy

Input

Argument Name Description Required
case_id The ID of the eDiscovery case. Required
hold_policy_id The policy ID that is intended to be updated. Required
description The description of the legal hold policy. Optional
content_query KQL query specifying content to be held in the specified locations. Learn about KQL (https://learn.microsoft.com/en-us/kusto/query/?view=azure-data-explorer&preserve-view=true). Optional

Context Output

There is no context output for this command.

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

  • Fetch incidents

</~PLATFORM>

Configuration parameters

  • azure_cloud — Azure Cloud
  • host — Host URL
  • creds_auth_id —
  • creds_tenant_id —
  • creds_enc_key —
  • auth_id — Application ID or Client ID
  • tenant_id — Token or Tenant ID
  • enc_key — Key or Client Secret
  • creds_certificate — Certificate Thumbprint
  • certificate_thumbprint — Certificate Thumbprint
  • private_key — Private Key
  • redirect_uri — Application redirect URI (for self-deployed mode)
  • auth_code — Authorization code
  • use_managed_identities — Use Azure Managed Identities
  • managed_identities_client_id —
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • self_deployed — Use a self-deployed Azure application
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • fetch_incidents_type — Fetch incidents type
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • fetch_limit — Fetch limit per type
  • fetch_service_sources — Alerts Service Sources
  • fetch_filter — Alerts Filter
  • fetch_incidents_filter — Incidents Filter
  • microsoft_365_defender_context — Microsoft 365 Defender context

Commands (48)

  • ms-graph-security-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • msg-activate-ediscovery-custodian

    Activate a custodian that has been released from a case to make them part of the case again. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery-manage-new-custodians?view=o365-worldwide#re-activate-custodian.

  • msg-advanced-hunting

    Advanced hunting is a threat-hunting tool that uses specially constructed queries to examine the past 30 days of event data in Microsoft Graph Security.

  • msg-apply-hold-ediscovery-custodian

    Start the process of applying hold on eDiscovery custodians. Available return statuses: notApplied - The custodian is not on hold (all sources in it are not on hold). applied - The custodian is on hold (all sources are on hold). applying - The custodian is in applying the hold state (applyHold operation triggered). removing - The custodian is in removing the hold state(removeHold operation triggered). partial - The custodian is in a mixed state where some sources are on hold and some not on hold or error state.

  • msg-auth-test

    Tests connectivity to Microsoft Graph Security.

  • msg-close-ediscovery-case

    Close an eDiscovery case. When the legal case or investigation supported by a eDiscovery (Standard) case is completed, you can close the case. Here's what happens when you close a case: If the case contains any eDiscovery holds, they'll be turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This helps prevent content from being immediately deleted and provides admins the opportunity to search for and restore content before it may be permanently deleted after the delay hold period expires. For more information, see Removing content locations from an eDiscovery hold. Closing a case only turns off the holds that are associated with that case. If other holds are placed on a content location (such as a Litigation Hold, a retention policy, or a hold from a different eDiscovery (Standard) case) those holds will still be maintained. The case is still listed on the eDiscovery (Standard) page in the Microsoft Purview compliance portal. The details, holds, searches, and members of a closed case are retained. You can edit a case after it's closed. For example, you can add or remove members, create searches, and export search results. The primary difference between active and closed cases is that eDiscovery holds are turned off when a case is closed.

  • msg-create-alert-comment

    Create a comment for an existing alert.

  • msg-create-ediscovery-case

    Create a new eDiscovery case. This command only creates an eDiscovery (Premium) case using the new case format. To learn more about the new case format in eDiscovery, see https://learn.microsoft.com/en-us/microsoft-365/compliance/advanced-ediscovery-new-case-format.

  • msg-create-ediscovery-case-hold-policy

    Create a new ediscoveryHoldPolicy object.

  • msg-create-ediscovery-custodian

    Create a new ediscoveryCustodian object. After the custodian object is created, you will need to create the custodian's userSource to reference their mailbox and OneDrive for Business site.

  • msg-create-ediscovery-custodian-site-source

    Create a new siteSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

  • msg-create-ediscovery-custodian-user-source

    Create a new userSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

  • msg-create-ediscovery-non-custodial-data-source

    Create a new eDiscoveryNoncustodialDataSource object.

  • msg-create-ediscovery-search

    Create a new eDiscoverySearch object.

  • msg-create-email-file-assessment-request

    Create email file assessment request.

  • msg-create-file-assessment-request

    Create file assessment request.

  • msg-create-mail-assessment-request

    Create and retrieve a mail threat assessment.

  • msg-create-url-assessment-request

    Create the URL assessment request.

  • msg-delete-ediscovery-case

    Delete an eDiscovery case. Before you can delete a case, you must first delete all holds listed on the holds page of the case. That includes deleting holds with a status of Off. Default hold policies can only be deleted when the hold is turned off. You must close an active case to turn off any default hold policies in the case. Once the holds are turned off for default hold policies, they can be deleted.

  • msg-delete-ediscovery-case-hold-policy

    Delete an eDiscovery hold policy. This command submits a deletion request to Microsoft Graph; the policy may not be removed immediately and can take some time to complete.

  • msg-delete-ediscovery-search

    Delete an eDiscoverySearch object.

  • msg-export-result-ediscovery-data

    Export results from an estimated ediscoverySearch. For details, see Manage a collection estimate (https://learn.microsoft.com/en-us/purview/ediscovery-create-draft-collection#manage-a-collection-estimate).

  • msg-generate-login-url

    Generate the login URL used for authorization code flow.

  • msg-get-alert-details

    Get details for a specific alert.

  • msg-get-last-estimate-statistics-operation

    Retrieves the most recent eDiscovery estimate statistics operation for a given search in Microsoft Purview. Use this command after running 'msg-run-estimate-statistics' to check the results.

  • msg-get-user Deprecated

    Deprecated. Use the Entra ID Users integration instead.

  • msg-get-users Deprecated

    Deprecated. Use the Entra ID Users integration instead.

  • msg-list-case-operation

    Get a list of the caseOperation objects and their properties, or retrieve a specific operation by ID. When operation_id is provided, you can set download_file=true to download the export report (if available).

  • msg-list-ediscovery-case-hold-policy

    Get a list of the ediscoveryHoldPolicy objects and their properties.

  • msg-list-ediscovery-cases

    Get a list of the eDiscovery cases.

  • msg-list-ediscovery-custodian-site-sources

    Get a list of the siteSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

  • msg-list-ediscovery-custodian-user-sources

    Get a list of the userSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

  • msg-list-ediscovery-custodians

    Get a list of the custodians on a given eDiscovery case.

  • msg-list-ediscovery-non-custodial-data-sources

    Get a list of the non-custodial data sources and their properties.

  • msg-list-ediscovery-searchs

    Get a list of eDiscoverySearch resources from an eDiscovery case.

  • msg-list-security-incident

    Get a list of incident objects that Microsoft graph created to track attacks in an organization. If you want a specific incident, just enter incident_id.

  • msg-list-threat-assessment-requests

    Get a list of the threat assessment requests.

  • msg-purge-ediscovery-data

    Deletes mailbox items in Exchange or messages in Microsoft Teams that are included in an eDiscovery search. You can collect and purge the following categories of Teams content: Teams 1:1 chats - Chat messages, posts, and attachments shared in a Teams conversation between two people. Teams 1:1 chats are also called conversations. Teams group chats - Chat messages, posts, and attachments shared in a Teams conversation between three or more people. Also called 1:N chats or group conversations. Teams channels - Chat messages, posts, replies, and attachments shared in a standard Teams channel. Private channels - Message posts, replies, and attachments shared in a private Teams channel. Shared channels - Message posts, replies, and attachments shared in a shared Teams channel.

  • msg-release-ediscovery-custodian

    Release a custodian from a case. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/manage-new-custodians#release-a-custodian-from-a-case.

  • msg-remove-hold-ediscovery-custodian

    Start the process of removing a hold from eDiscovery custodians.

  • msg-reopen-ediscovery-case

    Reopen an eDiscovery case. When you reopen an eDiscovery (Premium) case, any holds that were in place when the case was closed won't be automatically reinstated. After the case is reopened, you'll have to go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, and then set the Status toggle to On.

  • msg-run-estimate-statistics

    Starts an eDiscovery estimate statistics operation in Microsoft Purview. The operation calculates the size and number of items matching the search query.

  • msg-search-alerts

    Get a list of alerts (security issues) within a customer's tenant that Microsoft or partner security solutions have identified.

  • msg-update-alert

    Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions using its reference ID.

  • msg-update-ediscovery-case

    Update an eDiscovery case.

  • msg-update-ediscovery-case-hold-policy

    Update the properties of an ediscoveryHoldPolicy object.

  • msg-update-ediscovery-search

    Update an eDiscoverySearch object.

  • msg-update-security-incident

    Update the incident with the given ID.

Source

MicrosoftGraphSecurity.py MicrosoftGraphSecurity_test.py MicrosoftGraphSecurity.yml MicrosoftGraphSecurity_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft Graph
  version: -1
configuration:
- defaultvalue: Worldwide
  display: Azure Cloud
  name: azure_cloud
  required: false
  type: 15
  options:
  - Worldwide
  - US GCC
  - US GCC-High
  - DoD
  - Germany
  - China
  - Custom
  additionalinfo: When selecting the Custom option, the Host URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud
  section: Connect
  advanced: true
- display: Host URL
  name: host
  required: false
  type: 0
  section: Connect
  advanced: true
  additionalinfo: The host URL. When using this parameter, select the Custom option for the Azure Cloud. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud
- name: creds_auth_id
  type: 9
  section: Connect
  displaypassword: Application ID or Client ID
  hiddenusername: true
  required: false
- name: creds_tenant_id
  type: 9
  section: Connect
  displaypassword: Token or Tenant ID
  hiddenusername: true
  required: false
- name: creds_enc_key
  type: 9
  section: Connect
  displaypassword: Key or Client Secret
  hiddenusername: true
  required: false
- additionalinfo: See the Help tab.
  display: Application ID or Client ID
  name: auth_id
  type: 4
  section: Connect
  hidden: true
  required: false
- additionalinfo: See the Help tab.
  display: Token or Tenant ID
  name: tenant_id
  type: 4
  section: Connect
  hidden: true
  required: false
- display: Key or Client Secret
  name: enc_key
  type: 4
  section: Connect
  additionalinfo: See the Help tab.
  hidden: true
  required: false
- display: Certificate Thumbprint
  name: creds_certificate
  type: 9
  section: Connect
  displaypassword: Private Key
  required: false
- display: Certificate Thumbprint
  name: certificate_thumbprint
  type: 4
  section: Connect
  additionalinfo: Used for certificate authentication as it appears in the "Certificates & secrets" page of the app.
  hidden: true
  required: false
- display: Private Key
  name: private_key
  type: 14
  section: Connect
  additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  hidden: true
  required: false
- display: Application redirect URI (for self-deployed mode)
  name: redirect_uri
  type: 0
  section: Connect
  required: false
- additionalinfo: Get the authorization code from steps 3-5 in the self deployed authorization process.
  displaypassword: Authorization code
  name: auth_code
  hiddenusername: true
  type: 9
  section: Connect
  required: false
  display: Authorization code
- display: Use Azure Managed Identities
  name: use_managed_identities
  type: 8
  section: Connect
  required: false
  additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.
- name: managed_identities_client_id
  type: 9
  section: Connect
  required: false
  additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  hiddenusername: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
  advanced: true
- display: Use a self-deployed Azure application
  name: self_deployed
  type: 8
  section: Connect
  required: false
  additionalinfo: Select this checkbox if you are using a self-deployed Azure application.
  advanced: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents type
  name: fetch_incidents_type
  type: 16
  section: Collect
  required: false
  defaultvalue: Alerts
  additionalinfo: Select which record types to fetch. You can select Alerts, Incidents, or both.
  options:
  - Alerts
  - Incidents
  supportedModules:
  - agentix
  - xsiam
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  additionalinfo: <number> <time unit>, for example 1 hour, 30 minutes
  name: fetch_time
  type: 0
  section: Collect
  required: false
  defaultvalue: 3 days
- display: Fetch limit per type
  additionalinfo: The maximum number of items to fetch per type. Applies to both alerts and incidents. Note that when fetching incidents, no more than 50 can be fetched per cycle, due to a Microsoft limitation.
  name: fetch_limit
  type: 0
  section: Collect
  required: false
  defaultvalue: '50'
- display: Alerts Service Sources
  additionalinfo: Relevant only when fetching alerts. A comma-separated list of service sources, for example, "microsoftDefenderForEndpoint,microsoftDefenderForIdentity". If empty, alerts from all service sources will be fetched.
  name: fetch_service_sources
  type: 0
  section: Collect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Alerts Filter
  additionalinfo: Filters fetched alerts according to their properties. Relevant only when fetching alerts. Overrides the service sources list, if provided. The filter format must be {property} eq '{property-value}'. Multiple filters can be separated by " and ", for example, "createdDateTime eq YYYY-MM-DD and severity eq 'high'".
  name: fetch_filter
  type: 0
  section: Collect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Filter
  additionalinfo: Filters fetched incidents according to their properties. Relevant only when fetching incidents. The filter format must be {property} eq '{property-value}'. Multiple filters can be separated by " and ", for example, "severity eq 'high' and status eq 'active'".
  name: fetch_incidents_filter
  type: 0
  section: Collect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Microsoft 365 Defender context
  name: microsoft_365_defender_context
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: When selected, the hunting query result is also saved to the Microsoft 365 Defender context path. Relevant only for the msg-advanced-hunting command.
  section: Collect
description: Unified gateway to security insights - all from a unified Microsoft Graph Security API.
display: Microsoft Graph Security
name: Microsoft Graph
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: When the alert was last modified in the following string format - YYYY-MM-DD.
      name: last_modified
      predefined:
      - Last24Hours
      - Last48Hours
      - LastWeek
    - auto: PREDEFINED
      description: Alert severity - set by vendor/provider.
      name: severity
      predefined:
      - unknown
      - informational
      - low
      - medium
      - high
    - description: Category of the alert, e.g. credentialTheft, ransomware (Categories can be added or removed by vendors.)
      name: category
    - description: The start time (creation time of alert) for the search in the following string format - YYYY-MM-DD.
      name: time_from
    - description: The end time (creation time of alert) for the search in the following string format -  YYYY-MM-DD.
      name: time_to
    - description: Use this field to filter on any of the alert properties in the format "{property} eq '{property-value}'", e.g. "category eq 'ransomware'".
      name: filter
    - auto: PREDEFINED
      description: Use this field to filter by an alert's classification.
      name: classification
      predefined:
      - unknown
      - truePositive
      - falsePositive
      - benignPositive
    - auto: PREDEFINED
      description: Use this field to filter the alerts by the service or product that created this alert.
      name: service_source
      predefined:
      - microsoftDefenderForEndpoint
      - microsoftDefenderForIdentity
      - microsoftDefenderForOffice365
      - microsoft365Defender
      - microsoftAppGovernance
      - microsoftDefenderForCloudApps
    - auto: PREDEFINED
      description: Use this field to filter by alert's status.
      name: status
      predefined:
      - unknown
      - new
      - inProgress
      - resolved
    - description: Page number to return, zero indexed.
      name: page
    - description: Number of results in a page. Default is 50. The limit is 2000.
      name: page_size
    - description: Number of total results to return. Default is 50.
      name: limit
      defaultValue: 50
    description: Get a list of alerts (security issues) within a customer's tenant that Microsoft or partner security solutions have identified.
    name: msg-search-alerts
    outputs:
    - contextPath: MsGraph.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: MsGraph.Alert.Title
      description: Alert title.
      type: string
    - contextPath: MsGraph.Alert.Category
      description: Alert category.
      type: string
    - contextPath: MsGraph.Alert.Severity
      description: Alert severity.
      type: string
    - contextPath: MsGraph.Alert.CreatedDate
      description: Alert created date.
      type: date
    - contextPath: MsGraph.Alert.Status
      description: Alert status.
      type: string
    - contextPath: MsGraph.Alert.ActorDisplayName
      description: Alert actor name.
      type: Unknown
    - contextPath: MsGraph.Alert.AlertWebUrl
      description: Alert web URL.
      type: String
    - contextPath: MsGraph.Alert.AssignedTo
      description: Alert assignee.
      type: Unknown
    - contextPath: MsGraph.Alert.Classification
      description: Alert classification.
      type: Unknown
    - contextPath: MsGraph.Alert.Description
      description: Alert description.
      type: String
    - contextPath: MsGraph.Alert.DetectionSource
      description: Alert detection source.
      type: String
    - contextPath: MsGraph.Alert.DetectorId
      description: Alert detector ID.
      type: String
    - contextPath: MsGraph.Alert.Determination
      description: Alert determination.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.@odata.Type
      description: Alert evidence type.
      type: String
    - contextPath: MsGraph.Alert.Evidence.AzureAdDeviceId
      description: Evidence azure device ID.
      type: String
    - contextPath: MsGraph.Alert.Evidence.CreatedDate
      description: Evidence creation time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.DefenderAvStatus
      description: Evidence Defender AV status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.DeviceDnsName
      description: Evidence device DNS name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FirstSeenDateTime
      description: Evidence first seen time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.HealthStatus
      description: Evidence health status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.MdeDeviceId
      description: Evidence MDE device ID.
      type: String
    - contextPath: MsGraph.Alert.Evidence.OnboardingStatus
      description: Evidence onboarding status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.OsBuild
      description: Evidence OS build.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.OsPlatform
      description: Evidence OS platform.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RbacGroupId
      description: Evidence RBAC group ID.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.RbacGroupName
      description: Evidence RBAC group name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RemediationStatus
      description: Evidence remediation status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RemediationStatusDetails
      description: Evidence remediation status details.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.RiskScore
      description: Evidence risk score.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Tags
      description: Evidence tags.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Verdict
      description: Evidence verdict.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Version
      description: Evidence version.
      type: String
    - contextPath: MsGraph.Alert.Evidence.VmMetadata
      description: Evidence VM metadata.
      type: Unknown
    - contextPath: MsGraph.Alert.FirstActivityDateTime
      description: Evidence first activity time.
      type: Date
    - contextPath: MsGraph.Alert.IncidentId
      description: Alert incident ID.
      type: String
    - contextPath: MsGraph.Alert.IncidentWebUrl
      description: Alert incident URL.
      type: String
    - contextPath: MsGraph.Alert.LastActivityDateTime
      description: Alert last activity time.
      type: Date
    - contextPath: MsGraph.Alert.LastUpdateDateTime
      description: Alert last update time.
      type: Date
    - contextPath: MsGraph.Alert.ProviderAlertId
      description: Alert provider ID.
      type: String
    - contextPath: MsGraph.Alert.RecommendedActions
      description: Alert recommended action.
      type: String
    - contextPath: MsGraph.Alert.ResolvedDateTime
      description: Alert closing time.
      type: Date
    - contextPath: MsGraph.Alert.ServiceSource
      description: Alert service source.
      type: String
    - contextPath: MsGraph.Alert.TenantId
      description: Alert tenant ID.
      type: String
    - contextPath: MsGraph.Alert.ThreatDisplayName
      description: Alert threat display name.
      type: Unknown
    - contextPath: MsGraph.Alert.ThreatFamilyName
      description: Alert threat family name.
      type: Unknown
  - arguments:
    - default: true
      description: The Alert ID - Provider-generated GUID/unique identifier.
      name: alert_id
      required: true
    - defaultValue: All
      description: 'Deprecated. Was used for Legacy Alerts only.'
      name: fields_to_include
      hidden: true
      deprecated: true
    description: Get details for a specific alert.
    name: msg-get-alert-details
    outputs:
    - contextPath: MsGraph.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: MsGraph.Alert.Title
      description: Alert title.
      type: string
    - contextPath: MsGraph.Alert.Category
      description: Alert category.
      type: string
    - contextPath: MsGraph.Alert.Severity
      description: Alert severity.
      type: string
    - contextPath: MsGraph.Alert.CreatedDate
      description: Alert created date.
      type: date
    - contextPath: MsGraph.Alert.Status
      description: Alert status.
      type: string
    - contextPath: MsGraph.Alert.@odata.Context
      description: Alert odata context.
      type: String
    - contextPath: MsGraph.Alert.ActorDisplayName
      description: Alert actor name.
      type: Unknown
    - contextPath: MsGraph.Alert.AlertWebUrl
      description: Alert web URL.
      type: String
    - contextPath: MsGraph.Alert.AssignedTo
      description: Alert assignee.
      type: Unknown
    - contextPath: MsGraph.Alert.Classification
      description: Alert classification.
      type: Unknown
    - contextPath: MsGraph.Alert.Comments.Comment
      description: Alert comment.
      type: String
    - contextPath: MsGraph.Alert.Comments.CreatedByDisplayName
      description: Alert comment creator name.
      type: String
    - contextPath: MsGraph.Alert.Comments.CreatedDate
      description: Alert comment creation time.
      type: Date
    - contextPath: MsGraph.Alert.Description
      description: Alert description.
      type: String
    - contextPath: MsGraph.Alert.DetectionSource
      description: Alert detection source.
      type: String
    - contextPath: MsGraph.Alert.DetectorId
      description: Alert detector ID.
      type: String
    - contextPath: MsGraph.Alert.Determination
      description: Alert determination.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.@odata.Type
      description: Alert evidence.
      type: String
    - contextPath: MsGraph.Alert.Evidence.CreatedDate
      description: Evidence creation time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.DetectionStatus
      description: Evidence detection status.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ImageFile.FileName
      description: Evidence image file name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ImageFile.FilePath
      description: Evidence image file path.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ImageFile.FilePublisher
      description: Evidence image file publisher.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ImageFile.FileSize
      description: Evidence image file size.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ImageFile.Issuer
      description: Evidence image file issuer.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ImageFile.Sha1
      description: Evidence image file SHA1 hash.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ImageFile.Sha256
      description: Evidence image file SHA256 hash.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ImageFile.Signer
      description: Evidence image file signer.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.MdeDeviceId
      description: Evidence MDE device ID.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ParentProcessCreationDateTime
      description: Evidence parent process creation time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.ParentProcessId
      description: Evidence parent process process ID.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.ParentProcessImageFile
      description: Evidence parent process image file.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ProcessCommandLine
      description: Evidence process command line.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ProcessCreationDateTime
      description:  Evidence process creation time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.ProcessId
      description:  Evidence process ID.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.RemediationStatus
      description: Evidence remediation status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RemediationStatusDetails
      description: Evidence remediation status details.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.UserAccount.AccountName
      description: Evidence user account name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.UserAccount.AzureAdUserId
      description: Evidence user account Azure AD user ID.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.UserAccount.DisplayName
      description: Evidence user account display name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.UserAccount.DomainName
      description: Evidence user account domain name.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.UserAccount.UserPrincipalName
      description: Evidence user account user principal name.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.UserAccount.UserSid
      description: Evidence user account user SID.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Verdict
      description: Evidence verdict.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.FileName
      description: Evidence file details file name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.FilePath
      description: Evidence file details file path.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.FilePublisher
      description: Evidence file details file publisher.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.FileDetails.FileSize
      description: Evidence file details file size.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.FileDetails.Issuer
      description: Evidence file details file issuer.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.FileDetails.Sha1
      description: Evidence file details SHA1 hash.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.Sha256
      description: Evidence file details SHA256 hash.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.Signer
      description: Evidence file details file signer.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.CֹountryLetterCode
      description: Evidence country letter code.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.IpAddress
      description: Evidence IP address.
      type: String
    - contextPath: MsGraph.Alert.Evidence.AzureAdDeviceId
      description: Evidence Azure AD device ID.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.DefenderAvStatus
      description: Evidence Defender AV status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.DeviceDnsName
      description: Evidence device DNS name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FirstSeenDateTime
      description: Evidence first seen time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.HealthStatus
      description: Evidence health status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.OnboardingStatus
      description: Evidence onboarding status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.OsBuild
      description: Evidence OS build.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.OsPlatform
      description: Evidence OS platform.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RbacGroupId
      description: Evidence RBAC group ID.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.RbacGroupName
      description: Evidence RBAC group name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RiskScore
      description: Evidence risk score.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Version
      description: Evidence version.
      type: String
    - contextPath: MsGraph.Alert.Evidence.VmMetadata
      description: Evidence VM metadata.
      type: Unknown
    - contextPath: MsGraph.Alert.FirstActivityDateTime
      description: Evidence first activity time.
      type: Date
    - contextPath: MsGraph.Alert.IncidentId
      description: Alert incident ID.
      type: String
    - contextPath: MsGraph.Alert.IncidentWebUrl
      description: Alert incident URL.
      type: String
    - contextPath: MsGraph.Alert.LastActivityDateTime
      description: Alert last activity time.
      type: Date
    - contextPath: MsGraph.Alert.LastUpdateDateTime
      description: Alert last update time.
      type: Date
    - contextPath: MsGraph.Alert.ProviderAlertId
      description: Alert provider ID.
      type: String
    - contextPath: MsGraph.Alert.RecommendedActions
      description: Alert recommended action.
      type: String
    - contextPath: MsGraph.Alert.ResolvedDateTime
      description: Alert closing time.
      type: Date
    - contextPath: MsGraph.Alert.ServiceSource
      description: Alert service source.
      type: String
    - contextPath: MsGraph.Alert.TenantId
      description: Alert tenant ID.
      type: String
    - contextPath: MsGraph.Alert.ThreatDisplayName
      description: Alert threat display name.
      type: Unknown
    - contextPath: MsGraph.Alert.ThreatFamilyName
      description: Alert threat family name.
      type: Unknown
  - arguments:
    - description: The Alert ID. Provider-generated GUID/unique identifier.
      name: alert_id
      required: true
    - description: Name of the analyst the alert is assigned to for triage, investigation, or remediation.
      name: assigned_to
    - auto: PREDEFINED
      description: Alert lifecycle status (stage).
      name: status
      predefined:
      - unknown
      - newAlert
      - inProgress
      - resolved
    - description: Deprecated. Was used for Legacy Alerts only.
      name: closed_date_time
      hidden: true
      deprecated: true
    - description: Deprecated. Was used for Legacy Alerts only.
      name: comments
      hidden: true
      deprecated: true
    - auto: PREDEFINED
      description: Deprecated. Was used for Legacy Alerts only.
      name: feedback
      predefined:
      - unknown
      - truePositive
      - falsePositive
      - benignPositive
      hidden: true
      deprecated: true
    - description: Deprecated. Was used for Legacy Alerts only.
      name: tags
      hidden: true
      deprecated: true
    - description: Deprecated. Was used for Legacy Alerts only.
      name: vendor_information
      hidden: true
      deprecated: true
    - description: Deprecated. Was used for Legacy Alerts only.
      name: provider_information
      hidden: true
      deprecated: true
    - auto: PREDEFINED
      description: Use this field to update the alert's classification.
      name: classification
      predefined:
      - unknown
      - truePositive
      - falsePositive
      - informationalExpectedActivity
    - auto: PREDEFINED
      description: Use this field to update the alert's determination.
      name: determination
      predefined:
      - unknown
      - malware
      - phishing
      - other
      - securityTesting
      - multiStagedAttack
      - maliciousUserActivity
      - lineOfBusinessApplication
      - unwantedSoftware
    description: Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions using its reference ID.
    name: msg-update-alert
    outputs:
    - contextPath: MsGraph.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: MsGraph.Alert.Status
      description: Alert status, will appear only if changed.
      type: string
  - arguments:
    - default: true
      description: The alert ID - Provider-generated GUID/unique identifier.
      name: alert_id
      required: true
    - description: The comment to add to each alert.
      isArray: true
      name: comment
      required: true
      type: string
    description: Create a comment for an existing alert.
    name: msg-create-alert-comment
    outputs:
    - contextPath: MsGraph.AlertComment.ID
      description: The alert ID that the comment was added to.
      type: String
    - contextPath: MsGraph.AlertComment.Comments.Comment
      description: The comment itself.
      type: String
    - contextPath: MsGraph.AlertComment.Comments.CreatedByDisplayName
      description: The comment's creator display name.
      type: String
    - contextPath: MsGraph.AlertComment.Comments.CreatedDate
      description: The comment's creation time.
      type: Date
  - deprecated: true
    description: Deprecated. Use the Entra ID Users integration instead.
    name: msg-get-users
    outputs:
    - contextPath: MsGraph.User.Email
      description: User email address.
      type: string
    - contextPath: MsGraph.User.ID
      description: User ID.
      type: string
    - contextPath: MsGraph.User.Title
      description: User job title.
      type: string
    - contextPath: MsGraph.User.Name
      description: User name.
      type: string
  - arguments:
    - default: true
      description: User ID of user to retreive.
      name: user_id
      required: true
    deprecated: true
    description: Deprecated. Use the Entra ID Users integration instead.
    name: msg-get-user
    outputs:
    - contextPath: MsGraph.User.Email
      description: User email address.
      type: string
    - contextPath: MsGraph.User.ID
      description: User ID.
      type: string
    - contextPath: MsGraph.User.Title
      description: User job title.
      type: string
    - contextPath: MsGraph.User.Name
      description: User name.
      type: string
  - description: Run this command if for some reason you need to rerun the authentication process.
    execution: false
    name: ms-graph-security-auth-reset
    arguments: []
  - deprecated: false
    arguments:
    - description: Which permissions the integration should have.
      name: permission_type
      isArray: true
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'ediscovery'
      - 'alerts'
      - 'threat assessment'
      - 'all'
    description: Tests connectivity to Microsoft Graph Security.
    execution: false
    name: msg-auth-test
  - arguments: []
    description: Generate the login URL used for authorization code flow.
    execution: false
    name: msg-generate-login-url
  - arguments:
    - description: The name of the eDiscovery case.
      isArray: false
      name: display_name
      required: true
    - description: The case description.
      isArray: false
      name: description
      required: false
    - description: The external case number for customer reference.
      isArray: false
      name: external_id
      required: false
    description: Create a new eDiscovery case. This command only creates an eDiscovery (Premium) case using the new case format. To learn more about the new case format in eDiscovery, see https://learn.microsoft.com/en-us/microsoft-365/compliance/advanced-ediscovery-new-case-format.
    execution: false
    name: msg-create-ediscovery-case
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.CaseId
      description: The ID of the eDiscovery case.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.CaseStatus
      description: 'The case status. Possible values are: unknown, active, pendingDelete, closing, closed, and closedWithError.'
      type: String
    - contextPath: MsGraph.eDiscoveryCase.CreatedDateTime
      description: 'The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.Description
      description: The case description.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.DisplayName
      description: The case name.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.ExternalId
      description: The external case number for customer reference.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.LastModifiedDateTime
      description: 'The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    description: |-
      Close an eDiscovery case. When the legal case or investigation supported by a eDiscovery (Standard) case is completed, you can close the case. Here's what happens when you close a case:
      If the case contains any eDiscovery holds, they'll be turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This helps prevent content from being immediately deleted and provides admins the opportunity to search for and restore content before it may be permanently deleted after the delay hold period expires. For more information, see Removing content locations from an eDiscovery hold.
      Closing a case only turns off the holds that are associated with that case. If other holds are placed on a content location (such as a Litigation Hold, a retention policy, or a hold from a different eDiscovery (Standard) case) those holds will still be maintained.
      The case is still listed on the eDiscovery (Standard) page in the Microsoft Purview compliance portal. The details, holds, searches, and members of a closed case are retained.
      You can edit a case after it's closed. For example, you can add or remove members, create searches, and export search results. The primary difference between active and closed cases is that eDiscovery holds are turned off when a case is closed.
    execution: false
    name: msg-close-ediscovery-case
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    description: Reopen an eDiscovery case. When you reopen an eDiscovery (Premium) case, any holds that were in place when the case was closed won't be automatically reinstated. After the case is reopened, you'll have to go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, and then set the Status toggle to On.
    execution: false
    name: msg-reopen-ediscovery-case
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    description: Delete an eDiscovery case. Before you can delete a case, you must first delete all holds listed on the holds page of the case. That includes deleting holds with a status of Off. Default hold policies can only be deleted when the hold is turned off. You must close an active case to turn off any default hold policies in the case. Once the holds are turned off for default hold policies, they can be deleted.
    execution: false
    name: msg-delete-ediscovery-case
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The name of the eDiscovery case.
      isArray: false
      name: display_name
      required: true
    - description: The case description.
      isArray: false
      name: description
      required: false
    - description: The external case number for customer reference.
      isArray: false
      name: external_id
      required: false
    description: Update an eDiscovery case.
    execution: false
    name: msg-update-ediscovery-case
  - arguments:
    - description: The ID of the eDiscovery case. If provided, only this ID will be returned.
      isArray: false
      name: case_id
      required: false
    - description: The maximum number of results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of the eDiscovery cases.
    execution: false
    name: msg-list-ediscovery-cases
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.CaseId
      description: The ID of the eDiscovery case.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.CaseStatus
      description: 'The case status. Possible values are: unknown, active, pendingDelete, closing, closed, and closedWithError.'
      type: String
    - contextPath: MsGraph.eDiscoveryCase.CreatedDateTime
      description: 'The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.Description
      description: The case description.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.DisplayName
      description: The case name.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.ExternalId
      description: The external case number for customer reference.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.LastModifiedDateTime
      description: 'The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.ClosedBy.User.DisplayName
      description: The user who closed the case.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.LastModifiedBy.User.DisplayName
      description: The user who last modified the case.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.ClosedDateTime
      description: 'The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: Custodian's primary SMTP address.
      isArray: false
      name: email
      required: true
    description: Create a new ediscoveryCustodian object. After the custodian object is created, you will need to create the custodian's userSource to reference their mailbox and OneDrive for Business site.
    execution: false
    name: msg-create-ediscovery-custodian
    outputs:
    - contextPath: MsGraph.eDiscoveryCustodian.CreatedDateTime
      description: Date and time when the custodian was added to the case.
      type: Date
    - contextPath: MsGraph.eDiscoveryCustodian.CustodianId
      description: The ID for the custodian in the specified case. Read-only.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.CustodianStatus
      description: 'Status of the custodian. Possible values are: active, released.'
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.DisplayName
      description: Display name of the custodian.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.Email
      description: Email address of the custodian.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.HoldStatus
      description: 'The hold status of the custodian.The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.LastModifiedDateTime
      description: Date and time the custodian object was last modified.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case. If provided, only this ID will be returned.
      isArray: false
      name: custodian_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of the custodians on a given eDiscovery case.
    execution: false
    name: msg-list-ediscovery-custodians
    outputs:
    - contextPath: MsGraph.eDiscoveryCustodian.CreatedDateTime
      description: Date and time when the custodian was added to the case.
      type: Date
    - contextPath: MsGraph.eDiscoveryCustodian.CustodianId
      description: The ID for the custodian in the specified case. Read-only.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.CustodianStatus
      description: 'Status of the custodian. Possible values are: active, released.'
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.DisplayName
      description: Display name of the custodian.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.Email
      description: Email address of the custodian.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.HoldStatus
      description: 'The hold status of the custodian. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.LastModifiedDateTime
      description: Date and time the custodian object was last modified.
      type: Date
    - contextPath: MsGraph.eDiscoveryCustodian.ReleasedDateTime
      description: Date and time the custodian was released from the case.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    description: Release a custodian from a case. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/manage-new-custodians#release-a-custodian-from-a-case.
    execution: false
    name: msg-release-ediscovery-custodian
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    description: Activate a custodian that has been released from a case to make them part of the case again. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery-manage-new-custodians?view=o365-worldwide#re-activate-custodian.
    execution: false
    name: msg-activate-ediscovery-custodian
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    - description: SMTP address of the user.
      isArray: false
      name: email
      required: true
    - description: Specifies which sources are included in this group.
      isArray: true
      name: included_sources
      required: true
      auto: PREDEFINED
      predefined:
      - mailbox
      - site
      - mailbox, site
    description: Create a new userSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
    execution: false
    name: msg-create-ediscovery-custodian-user-source
    outputs:
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.Application.DisplayName
      description: The name of the application who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.Application.ID
      description: The ID of the application who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.DisplayName
      description: The name of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.ID
      description: The ID of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedDateTime
      description: The date and time the userSource was created.
      type: Date
    - contextPath: MsGraph.CustodianUserSource.DisplayName
      description: The display name associated with the mailbox and site.
      type: String
    - contextPath: MsGraph.CustodianUserSource.Email
      description: Email address of the user's mailbox.
      type: String
    - contextPath: MsGraph.CustodianUserSource.HoldStatus
      description: 'The hold status of the userSource. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.CustodianUserSource.IncludedSources
      description: 'Specifies which sources are included in this group. Possible values are: mailbox, site.'
      type: String
    - contextPath: MsGraph.CustodianUserSource.UserSourceId
      description: The ID of the userSource. This is not the ID of the actual group.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    - description: URL of the site, for example, https://contoso.sharepoint.com/sites/HumanResources.
      isArray: false
      name: site
      required: true
    description: Create a new siteSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
    execution: false
    name: msg-create-ediscovery-custodian-site-source
    outputs:
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.Application.DisplayName
      description: The name of the application who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.Application.ID
      description: The ID of the application who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.DisplayName
      description: The name of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.ID
      description: The ID of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedDateTime
      description: The date and time the siteSource was created.
      type: Date
    - contextPath: MsGraph.CustodianSiteSource.DisplayName
      description: The display name of the siteSource. This will be the name of the SharePoint site.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.HoldStatus
      description: 'The hold status of the siteSource. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.CustodianSiteSource.SiteSourceId
      description: The ID of the siteSource.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    - description: The ID of the userSource. If provided, only this ID will be returned.
      isArray: false
      name: user_source_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of the userSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
    execution: false
    name: msg-list-ediscovery-custodian-user-sources
    outputs:
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.Application.DisplayName
      description: The name of the application who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.Application.ID
      description: The ID of the application who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.DisplayName
      description: The name of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.ID
      description: The ID of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedDateTime
      description: The date and time the userSource was created.
      type: Date
    - contextPath: MsGraph.CustodianUserSource.DisplayName
      description: The display name associated with the mailbox and site.
      type: String
    - contextPath: MsGraph.CustodianUserSource.Email
      description: Email address of the user's mailbox.
      type: String
    - contextPath: MsGraph.CustodianUserSource.HoldStatus
      description: 'The hold status of the userSource. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.CustodianUserSource.IncludedSources
      description: 'Specifies which sources are included in this group. Possible values are: mailbox, site.'
      type: String
    - contextPath: MsGraph.CustodianUserSource.SiteWebUrl
      description: The URL of the user's OneDrive for Business site. Read-only.
      type: String
    - contextPath: MsGraph.CustodianUserSource.UserSourceId
      description: The ID of the userSource. This is not the ID of the actual group.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    - description: The ID of the siteSource. If provided, only this ID will be returned.
      isArray: false
      name: site_source_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of the siteSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
    execution: false
    name: msg-list-ediscovery-custodian-site-sources
    outputs:
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.Application.DisplayName
      description: The name of the application who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.Application.ID
      description: The ID of the application who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.DisplayName
      description: The name of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.ID
      description: The ID of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedDateTime
      description: The date and time the siteSource was created.
      type: Date
    - contextPath: MsGraph.CustodianSiteSource.DisplayName
      description: The display name of the siteSource. This will be the name of the SharePoint site.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.HoldStatus
      description: 'The hold status of the siteSource. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.CustodianSiteSource.SiteSourceId
      description: The ID of the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.Site.ID
      description: The unique identifier of the item. Read-only.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.Site.WebUrl
      description: URL that displays the item in the browser. Read-only.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.Site.CreatedDate
      description: The date and time the siteSource was created.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: URL of the site, for example, https://contoso.sharepoint.com/sites/HumanResources.
      isArray: false
      name: site
      required: false
    - description: Email address of the user's mailbox.
      isArray: false
      name: email
      required: false
    description: Create a new eDiscoveryNoncustodialDataSource object.
    execution: false
    name: msg-create-ediscovery-non-custodial-data-source
    outputs:
    - contextPath: MsGraph.NoncustodialDataSource.CreatedDateTime
      description: Created date and time of the nonCustodialDataSource.
      type: Date
    - contextPath: MsGraph.NoncustodialDataSource.DataSourceId
      description: Unique identifier of the nonCustodialDataSource.
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.DataSourceStatus
      description: 'Latest status of the nonCustodialDataSource. Possible values are: Active, Released.'
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.DisplayName
      description: Display name of the noncustodialDataSource.
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.HoldStatus
      description: 'The hold status of the nonCustodialDataSource.The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.LastModifiedDateTime
      description: Last modified date and time of the nonCustodialDataSource.
      type: Date
    - contextPath: MsGraph.NoncustodialDataSource.ReleasedDateTime
      description: Date and time that the nonCustodialDataSource was released from the case.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the dataSource. If provided, only this ID will be returned.
      isArray: false
      name: data_source_id
      required: false
    - description: The maximum number of results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
    description: Get a list of the non-custodial data sources and their properties.
    execution: false
    name: msg-list-ediscovery-non-custodial-data-sources
    outputs:
    - contextPath: MsGraph.NoncustodialDataSource.CreatedDateTime
      description: Created date and time of the nonCustodialDataSource.
      type: Date
    - contextPath: MsGraph.NoncustodialDataSource.DataSourceId
      description: Unique identifier of the nonCustodialDataSource.
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.DataSourceStatus
      description: 'Latest status of the nonCustodialDataSource. Possible values are: Active, Released.'
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.DisplayName
      description: Display name of the noncustodialDataSource.
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.HoldStatus
      description: 'The hold status of the nonCustodialDataSource.The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.LastModifiedDateTime
      description: Last modified date and time of the nonCustodialDataSource.
      type: Date
    - contextPath: MsGraph.NoncustodialDataSource.ReleasedDateTime
      description: Date and time that the nonCustodialDataSource was released from the case.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: A comma-separated list of custodians IDs to apply a hold to.
      isArray: true
      name: custodian_id
      required: true
    description: |-
      Start the process of applying hold on eDiscovery custodians.
      Available return statuses: 
      notApplied - The custodian is not on hold (all sources in it are not on hold).
      applied - The custodian is on hold (all sources are on hold).
      applying - The custodian is in applying the hold state (applyHold operation triggered).
      removing - The custodian is in removing the hold state(removeHold operation triggered).
      partial - The custodian is in a mixed state where some sources are on hold and some not on hold or error state.
    execution: false
    name: msg-apply-hold-ediscovery-custodian
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: A comma-separated list of custodians IDs to remove a hold from.
      isArray: true
      name: custodian_id
      required: true
    description: Start the process of removing a hold from eDiscovery custodians.
    execution: false
    name: msg-remove-hold-ediscovery-custodian
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The display name of the search.
      isArray: false
      name: display_name
      required: true
    - description: The description of the search.
      isArray: false
      name: description
      required: false
    - description: The query string used for the search. The query string format is KQL (Keyword Query Language). For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values, for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
      isArray: false
      name: content_query
      required: false
    - description: When specified, the collection will span across a service for an entire workload.
      isArray: false
      name: data_source_scopes
      required: false
      auto: PREDEFINED
      predefined:
      - none
      - allTenantMailboxes
      - allTenantSites
      - allCaseCustodians
      - allCaseNoncustodialDataSources
    description: Create a new eDiscoverySearch object.
    execution: false
    name: msg-create-ediscovery-search
    outputs:
    - contextPath: MsGraph.eDiscoverySearch.ContentQuery
      description: 'The query string in KQL (Keyword Query Language) query. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.'
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.Application.DisplayName
      description: Name of the application who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.Application.ID
      description: ID of the application who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.DisplayName
      description: Name of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.ID
      description: ID of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedDateTime
      description: The date and time the eDiscovery search was created.
      type: Date
    - contextPath: MsGraph.eDiscoverySearch.DataSourceScopes
      description: 'When specified, the collection will span across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources.'
      type: String
    - contextPath: MsGraph.eDiscoverySearch.Description
      description: The description of the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.DisplayName
      description: The display name of the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedDateTime
      description: 'The last date and time the eDiscovery search was modified.'
      type: Date
    - contextPath: MsGraph.eDiscoverySearch.SearchId
      description: The ID for the eDiscovery search.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: true
    - description: The display name of the search.
      isArray: false
      name: display_name
      required: true
    - description: The description of the search.
      isArray: false
      name: description
      required: false
    - description: The query string used for the search. The format of the query string is KQL (Keyword Query Language). For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values, for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
      isArray: false
      name: content_query
      required: false
    - description: When specified, the collection will span across a service for an entire workload.
      isArray: false
      name: data_source_scopes
      required: false
      auto: PREDEFINED
      predefined:
      - none
      - allTenantMailboxes
      - allTenantSites
      - allCaseCustodians
      - allCaseNoncustodialDataSources
    description: Update an eDiscoverySearch object.
    execution: false
    name: msg-update-ediscovery-search
  - arguments:
    - description: The id of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search. If provided, only this ID will be returned.
      isArray: false
      name: search_id
      required: false
    - description: The maximum number of results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of eDiscoverySearch resources from an eDiscovery case.
    execution: false
    name: msg-list-ediscovery-searchs
    outputs:
    - contextPath: MsGraph.eDiscoverySearch.ContentQuery
      description: 'The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values, for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.'
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.Application.DisplayName
      description: Name of the application who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.Application.ID
      description: ID of the application who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.DisplayName
      description: Name of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.ID
      description: ID of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedDateTime
      description: The date and time the eDiscovery search was created.
      type: Date
    - contextPath: MsGraph.eDiscoverySearch.DataSourceScopes
      description: 'When specified, the collection will span across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources.'
      type: String
    - contextPath: MsGraph.eDiscoverySearch.Description
      description: The description of the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.DisplayName
      description: The display name of the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.SearchId
      description: The ID for the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedDateTime
      description: The last date and time the eDiscovery search was modified.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.Application.DisplayName
      description: Name of the application who last modified the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.Application.ID
      description: ID of the application who last modified the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.User.DisplayName
      description: Name of the user who last modified the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.User.ID
      description: ID of the user who last modified the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.User.UserPrincipalName
      description: Internet-style login name of the user who last modified the eDiscovery search.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: false
    description: Delete an eDiscoverySearch object.
    execution: true
    name: msg-delete-ediscovery-search
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: true
    - description: "Specify the statistics to generate. The possible values are: includeRefiners, includeQueryStats, includeUnindexedStats, advancedIndexing, locationsWithoutHits. The advancedIndexing and locationsWithoutHits values are only considered if includeUnindexedStats is set."
      isArray: false
      name: statistics_options
      required: false
      auto: PREDEFINED
      predefined:
        - 'includeRefiners'
        - 'includeQueryStats'
        - 'includeUnindexedStats'
        - 'advancedIndexing'
        - 'locationsWithoutHits'
    description: Starts an eDiscovery estimate statistics operation in Microsoft Purview. The operation calculates the size and number of items matching the search query.
    execution: false
    name: msg-run-estimate-statistics
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: true
    outputs:
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.CaseID
        description: The ID of the eDiscovery case.
        type: String
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.SearchID
        description: The ID of the eDiscovery search.
        type: String
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.OperationID
        description: The ID of the last estimate statistics operation.
        type: String
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.Status
        description: The current status of the last estimate statistics operation (e.g., running, succeeded, failed).
        type: String
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.PercentProgress
        description: The percent progress of the last estimate statistics operation.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.CreatedDateTime
        description: The date and time when the estimate operation was created.
        type: Date
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.CompletedDateTime
        description: The date and time when the estimate operation completed.
        type: Date
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.IndexedItemsCount
        description: The number of indexed items found in the search.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.IndexedItemsSize
        description: The total size (in bytes) of indexed items.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.UnindexedItemsCount
        description: The number of unindexed items found in the search.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.UnindexedItemsSize
        description: The total size (in bytes) of unindexed items.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.TotalItemsCount
        description: The total number of items (indexed + unindexed).
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.TotalItemsSize
        description: The total size (in bytes) of all items (indexed + unindexed).
        type: Number
    description:  Retrieves the most recent eDiscovery estimate statistics operation for a given search in Microsoft Purview. Use this command after running 'msg-run-estimate-statistics' to check the results.
    execution: false
    polling: true
    name: msg-get-last-estimate-statistics-operation
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: true
    - description: Whether the action is soft delete or hard delete.
      isArray: false
      name: purge_type
      required: false
      auto: PREDEFINED
      predefined:
      - permanentlyDelete
      - recoverable
    - description: Define the locations to be in scope of the purge action.
      isArray: false
      name: purge_areas
      required: false
      auto: PREDEFINED
      predefined:
      - teamsMessages
      - mailboxes
    description: |-
      Deletes mailbox items in Exchange or messages in Microsoft Teams that are included in an eDiscovery search.

      You can collect and purge the following categories of Teams content:

      Teams 1:1 chats - Chat messages, posts, and attachments shared in a Teams conversation between two people. Teams 1:1 chats are also called conversations.
      Teams group chats - Chat messages, posts, and attachments shared in a Teams conversation between three or more people. Also called 1:N chats or group conversations.
      Teams channels - Chat messages, posts, replies, and attachments shared in a standard Teams channel.
      Private channels - Message posts, replies, and attachments shared in a private Teams channel.
      Shared channels - Message posts, replies, and attachments shared in a shared Teams channel.
    execution: false
    name: msg-purge-ediscovery-data
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.Purge.OperationID
      description: The ID of the purge operation. Use this ID to retrieve the operation status via 'msg-list-case-operation'.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Purge.Status
      description: The status of the purge operation.
      type: String
  - arguments:
    - description: The email address of the user who received the email.
      isArray: false
      name: recipient_email
      required: true
    - description: The expected assessment.
      isArray: false
      name: expected_assessment
      auto: PREDEFINED
      predefined:
      - 'block'
      - 'unblock'
      required: true
    - description: The category of the threat.
      isArray: false
      name: category
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'spam'
      - 'phishing'
      - 'malware'
      required: true
    - description: Message user. Could be the user's ID or the user's email.
      isArray: false
      name: message_user
      required: true
    - description: "Message ID. Message has to contain the 'X-MS-Exchange-Organization-Network-Message-Id' header in the message or the 'X-MS-Office365-Filtering-Correlation-Id' header in quarantined messages. Use the msgraph-mail-list-emails command from the Microsoft Graph Mail pack  with the proper user_id in order to get all available messages."
      isArray: false
      name: message_id
      required: true
    - description: The ID of the request (generated in the polling command).
      name: request_id
      deprecated: true
    - description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
      deprecated: true
      defaultValue: '720'
    description: Create and retrieve a mail threat assessment.
    execution: false
    name: msg-create-mail-assessment-request
    polling: true
    outputs:
    - contextPath: MSGraphMail.MailAssessment.ID
      description: Mail assessment ID.
      type: String
    - contextPath: MSGraphMail.MailAssessment.CreatedDateTime
      description: The datetime the mail assessment was created.
      type: String
    - contextPath: MSGraphMail.MailAssessment.ContentType
      description: The content type.
      type: String
    - contextPath: MSGraphMail.MailAssessment.ExpectedAssessment
      description: The expected assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.Category
      description: The category of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.Status
      description: The status of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.RequestSource
      description: The request source of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.RecipientEmail
      description: The email recipient of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.DestinationRoutingReason
      description: The destination routing reason for the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.MessageID
      description: The message ID of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.CreatedUserID
      description: The user ID that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.CreatedUsername
      description: The user name that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.ResultType
      description: The result type of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.ResultMessage
      description: The result message of the mail assessment.
      type: String
  - arguments:
    - description: The email of the user who recieved the mail.
      isArray: false
      name: recipient_email
      required: true
    - description: The expected assessment.
      isArray: false
      name: expected_assessment
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'block'
      - 'unblock'
      required: true
    - description: The category of the threat.
      isArray: false
      name: category
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'spam'
      - 'phishing'
      - 'malware'
      required: true
    - description: Base 64 encoded eml file.
      isArray: false
      name: content_data
      required: false
    - description: Entry ID.
      isArray: false
      name: entry_id
      required: false
    - description: The ID of the request (generated in the polling command).
      name: request_id
      deprecated: true
    - description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
      deprecated: true
      defaultValue: '720'
    description: Create email file assessment request.
    execution: false
    name: msg-create-email-file-assessment-request
    polling: true
    outputs:
    - contextPath: MSGraphMail.EmailAssessment.ID
      description: The mail assessment ID.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.CreatedDateTime
      description: The datetime the mail assessment was created.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.ContentType
      description: The content type.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.ExpectedAssessment
      description: The expected assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.Category
      description: The category of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.Status
      description: The status of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.RequestSource
      description: The request source of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.RecipientEmail
      description: The email recipient of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.DestinationRoutingReason
      description: The destination routing reason for the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.CreatedUserID
      description: The user ID that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.CreatedUsername
      description: The user name that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.ResultType
      description: The result type of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.ResultMessage
      description: The result message of the mail assessment.
      type: String
  - arguments:
    - description: The expected assessment.
      isArray: false
      name: expected_assessment
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'block'
      - 'unblock'
      required: true
    - description: The category of the threat.
      isArray: false
      name: category
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'phishing'
      - 'malware'
      required: true
    - description: The file name.
      isArray: false
      name: file_name
      required: true
    - description: Base 64 encoded text file.
      isArray: false
      name: content_data
      required: false
    - description: Entry ID.
      isArray: false
      name: entry_id
      required: false
    - description: Whether to hide the polling result (automatically filled by polling).
      name: hide_polling_output
      deprecated: true
    - description: The ID of the request (generated in the polling command).
      name: request_id
      deprecated: true
    description: Create file assessment request.
    execution: false
    name: msg-create-file-assessment-request
    polling: true
    outputs:
    - contextPath: MSGraphMail.FileAssessment.ID
      description: The mail assessment ID.
      type: String
    - contextPath: MSGraphMail.FileAssessment.CreatedDateTime
      description: The datetime the file assessment was created.
      type: String
    - contextPath: MSGraphMail.FileAssessment.ContentType
      description: The content type.
      type: String
    - contextPath: MSGraphMail.FileAssessment.ExpectedAssessment
      description: The expected assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.Category
      description: The category of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.Status
      description: The status of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.RequestSource
      description: The request source of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.FileName
      description: The file name of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.CreatedUserID
      description: The user ID that was created for the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.CreatedUsername
      description: The user name that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.ResultType
      description: The result type of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.ResultMessage
      description: The result message of the file assessment.
      type: String
  - arguments:
    - description: The expected assessment.
      isArray: false
      name: expected_assessment
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'block'
      - 'unblock'
      required: true
    - description: The category of the threat.
      isArray: false
      name: category
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'phishing'
      - 'malware'
      required: true
    - description: The URL of the threat.
      isArray: false
      name: url
      required: true
    - description: The request_id (generated in the polling command).
      name: request_id
      deprecated: true
    - description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
      deprecated: true
      defaultValue: '720'
    description: Create the URL assessment request.
    execution: false
    name: msg-create-url-assessment-request
    polling: true
    outputs:
    - contextPath: MSGraphMail.UrlAssessment.ID
      description: The mail assessment ID.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.Url
      description: The URL of the URL assessment.
      type: string
    - contextPath: MSGraphMail.UrlAssessment.CreatedDateTime
      description: The datetime the URL assessment was created.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.ContentType
      description: The content type of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.ExpectedAssessment
      description: The expected assessment of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.Category
      description: The category of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.Status
      description: The status of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.RequestSource
      description: The request source for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.RecipientEmail
      description: The recipient email for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.DestinationRoutingReason
      description: The destination routing reason for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.CreatedUserID
      description: The user ID created for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.CreatedUsername
      description: The user name created for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.ResultType
      description: The result type of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.ResultMessage
      description: The result message of the URL assessment.
      type: String
  - arguments:
    - description: The request ID.
      isArray: false
      name: request_id
      required: false
    - description: The filter for the request. Example category eq 'malware’ and ContentType eq 'file'. Available fields are expectedAssessment, ContentType, status, requestSource.
      isArray: false
      name: filter
      required: false
    - description: The order by which to retrieve the results.
      isArray: false
      name: order_by
      auto: PREDEFINED
      predefined:
      - 'id'
      - 'createdDateTime'
      - 'ContentType'
      - 'expectedAssessment'
      - 'category'
      - 'status'
      - 'requestSource'
      required: false
    - description: The sort order.
      isArray: false
      name: sort_order
      auto: PREDEFINED
      predefined:
      - 'asc'
      - 'desc'
      required: false
    - description: The maximum number of results to retrieve.
      isArray: false
      name: limt
      required: false
    - description: The next token.
      isArray: false
      name: next_token
      required: false
    description: Get a list of the threat assessment requests.
    execution: false
    name: msg-list-threat-assessment-requests
    polling: true
    outputs:
    - contextPath: MsGraph.AssessmentRequestNextToken.next_token
      description: The next token for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ID
      description: The assessment request ID.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.CreatedDateTime
      description: The datetime the assessment request was created.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ContentType
      description: The content type of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ExpectedAssessment
      description: The expected assessment of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.Category
      description: The category of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.Status
      description: The status of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.URL
      description: The URL of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.RequestSource
      description: The request source for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.RecipientEmail
      description: The email recipient for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.FileName
      description: The file name of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.DestinationRoutingReason
      description: The destination routing reason for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.CreatedUserID
      description: The user ID create for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.CreatedUsername
      description: The user name created for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ResultType
      description: The result type of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ResultMessage
      description: The result message of the assessment request.
      type: String
  - arguments:
    - name: query
      description: Advanced hunting query.
      required: true
    - name: limit
      description: Number of entries. Enter -1 for unlimited query. In case a limit also appears in the query, priority will be given to the query.
      defaultValue: '50'
    - name: timeout
      description: The time limit in seconds for the http request to run.
      defaultValue: '50'
    description: Advanced hunting is a threat-hunting tool that uses specially constructed queries to examine the past 30 days of event data in Microsoft Graph Security.
    name: msg-advanced-hunting
    outputs:
    - contextPath: MsGraph.Hunt.query
      description: The query used. Also acted as a key.
      type: String
    - contextPath: MsGraph.Hunt.results
      description: The results of the query.
      type: Unknown
    - contextPath: Microsoft365Defender.Hunt.query
      description: The query used. Also acted as a key.
      type: String
    - contextPath: Microsoft365Defender.Hunt.results
      description: The results of the query.
      type: Unknown
  - arguments:
    - name: incident_id
      description: Incident's ID.
    - name: limit
      description: Number of incidents in the list. Maximum is 50.
      defaultValue: '50'
    - name: timeout
      description: The time limit in seconds for the http request to run.
      defaultValue: '50'
    - name: status
      description: The status of the incident.
      auto: PREDEFINED
      predefined:
      - 'active'
      - 'redirected'
      - 'resolved'
      - 'inProgress'
      - 'unknownFutureValue'
      - 'awaitingAction'
    - name: assigned_to
      description: Owner of the incident.
    - name: severity
      description: Indicates the possible impact on assets. The higher the severity, the greater the impact. Typically higher severity items require the most immediate attention.
      auto: PREDEFINED
      predefined:
      - 'unknown'
      - 'informational'
      - 'low'
      - 'medium'
      - 'high'
      - 'unknownFutureValue'
    - name: classification
      description: The specification for the incident.
    - name: odata
      description: Filter incidents using 'odata' query.
    - name: extra_data
      description: Whether to include each incident's related alerts in the response.
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    description: Get a list of incident objects that Microsoft graph created to track attacks in an organization. If you want a specific incident, just enter incident_id.
    name: msg-list-security-incident
    outputs:
    - contextPath: MsGraph.Incident.assignedTo
      description: Owner of the incident, or null if no owner is assigned. Free editable text.
      type: string
    - contextPath: MsGraph.Incident.classification
      description: The specification for the incident. Possible values are unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
      type: string
    - contextPath: MsGraph.Incident.comments
      description: Array of comments created by the Security Operations (SecOps) team when the incident is managed.
      type: string
    - contextPath: MsGraph.Incident.createdDateTime
      description: Time when the incident was first created.
      type: date
    - contextPath: MsGraph.Incident.customTags
      description: Array of custom tags associated with an incident.
      type: string
    - contextPath: MsGraph.Incident.description
      description: Description of the incident.
      type: string
    - contextPath: MsGraph.Incident.determination
      description: Specifies the determination of the incident. Possible values are unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.
      type: string
    - contextPath: MsGraph.Incident.displayName
      description: The incident name.
      type: string
    - contextPath: MsGraph.Incident.id
      description: Unique identifier to represent the incident.
      type: number
    - contextPath: MsGraph.Incident.incidentWebUrl
      description: The URL for the incident page in the Microsoft 365 Defender portal.
      type: string
    - contextPath: MsGraph.Incident.lastModifiedBy
      description: The identity that last modified the incident.
      type: string
    - contextPath: MsGraph.Incident.lastUpdateDateTime
      description: Time when the incident was last updated.
      type: string
    - contextPath: MsGraph.Incident.redirectIncidentId
      description: Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected.
      type: string
    - contextPath: MsGraph.Incident.severity
      description: Indicates the possible impact on assets. The higher the severity, the bigger the impact. Typically higher severity items require the most immediate attention. Possible values are unknown, informational, low, medium, high, unknownFutureValue.
      type: string
    - contextPath: MsGraph.Incident.status
      description: The status of the incident. Possible values are active, resolved, inProgress, redirected, unknownFutureValue, and awaitingAction.
      type: string
    - contextPath: MsGraph.Incident.tenantId
      description: The Microsoft Entra tenant in which the alert was created.
      type: string
    - contextPath: MsGraph.Incident.systemTags
      description: The system tags associated with the incident.
      type: string
  - arguments:
    - name: incident_id
      description: Incident's ID.
      required: true
    - name: status
      description: Categorize incidents (as Active, Resolved, or Redirected).
      auto: PREDEFINED
      predefined:
      - active
      - resolved
      - redirected
      - unknownFutureValue
    - name: assigned_to
      description: Owner of the incident.
    - name: determination
      description: Determination of the incident.
      auto: PREDEFINED
      predefined:
      - unknown
      - apt
      - malware
      - securityPersonnel
      - unwantedSoftware
      - other
      - multiStagedAttack
      - compromisedUser
      - phishing
      - maliciousUserActivity
      - notMalicious
    - name: classification
      description: The specification for the incident.
      auto: PREDEFINED
      predefined:
      - unknown
      - falsePositive
      - truePositive
      - informationalExpectedActivity
      - unknownFutureValue
    - name: severity
      description: 'Indicates the possible impact on assets. The higher the severity, the bigger the impact. Typically, higher severity items require the most immediate attention. The possible values are: unknown, informational, low, medium, high, unknownFutureValue.'
      auto: PREDEFINED
      predefined:
      - unknown
      - informational
      - low
      - medium
      - high
      - unknownFutureValue
    - name: resolving_comment
      description: User input that explains the resolution of the incident and the classification choice. It contains free editable text.
    - name: custom_tags
      description: Array of custom tags associated with an incident.
    - name: timeout
      description: The time limit in seconds for the http request to run.
      defaultValue: '50'
    description: Update the incident with the given ID.
    name: msg-update-security-incident
    outputs:
    - contextPath: MsGraph.Incident.assignedTo
      description: Owner of the incident, or null if no owner is assigned. Free editable text.
      type: String
    - contextPath: MsGraph.Incident.classification
      description: The specification for the incident. Possible values are unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
      type: String
    - contextPath: MsGraph.Incident.comments
      description: Array of comments created by the Security Operations (SecOps) team when the incident is managed.
      type: String
    - contextPath: MsGraph.Incident.createdDateTime
      description: Time when the incident was first created.
      type: Date
    - contextPath: MsGraph.Incident.customTags
      description: Array of custom tags associated with an incident.
      type: String
    - contextPath: MsGraph.Incident.description
      description: Description of the incident.
      type: String
    - contextPath: MsGraph.Incident.determination
      description: Specifies the determination of the incident. Possible values are unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.
      type: String
    - contextPath: MsGraph.Incident.displayName
      description: The incident name.
      type: String
    - contextPath: MsGraph.Incident.id
      description: Unique identifier to represent the incident.
      type: String
    - contextPath: MsGraph.Incident.incidentWebUrl
      description: The URL for the incident page in the Microsoft 365 Defender portal.
      type: String
    - contextPath: MsGraph.Incident.lastModifiedBy
      description: The identity that last modified the incident.
      type: String
    - contextPath: MsGraph.Incident.lastUpdateDateTime
      description: Time when the incident was last updated.
      type: Date
    - contextPath: MsGraph.Incident.redirectIncidentId
      description: Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected.
      type: String
    - contextPath: MsGraph.Incident.severity
      description: Indicates the possible impact on assets. The higher the severity, the bigger the impact. Typically higher severity items require the most immediate attention. Possible values are unknown, informational, low, medium, high, unknownFutureValue.
      type: String
    - contextPath: MsGraph.Incident.status
      description: The status of the incident. Possible values are active, resolved, inProgress, redirected, unknownFutureValue, and awaitingAction.
      type: String
    - contextPath: MsGraph.Incident.tenantId
      description: The Microsoft Entra tenant in which the alert was created.
      type: String
    - contextPath: MsGraph.Incident.systemTags
      description: The system tags associated with the incident.
      type: String collection
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The display name of the legal hold policy.
      isArray: false
      name: display_name
      required: true
    - description: The description of the legal hold policy.
      isArray: false
      name: description
      required: false
    - description: KQL query specifying content to be held in the specified locations. Learn about KQL (https://learn.microsoft.com/en-us/kusto/query/?view=azure-data-explorer&preserve-view=true).
      isArray: false
      name: content_query
      required: false
    description: Create a new ediscoveryHoldPolicy object.
    name: msg-create-ediscovery-case-hold-policy
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.ID
      description: The ID of the eDiscovery hold policy.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.DisplayName
      description: The display name of the legal hold.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Description
      description: The legal hold description.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.ContentQuery
      description: KQL query that specifies content to be held. If empty, all content in the specified locations is held.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.IsEnabled
      description: Indicates whether the hold is enabled and actively holding content.
      type: Boolean
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Status
      description: The status of the legal hold. Possible values are Pending, Error, Success.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Errors
      description: Lists any errors that happened while placing the hold.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedDateTime
      description: The date and time the legal hold was created.
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedDateTime
      description: The date and time the legal hold was last modified.
      type: Date
    # --- createdBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
    # --- lastModifiedBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The policy ID that is intended to be deleted.
      isArray: false
      name: hold_policy_id
      required: true
    description: Delete an eDiscovery hold policy. This command submits a deletion request to Microsoft Graph; the policy may not be removed immediately and can take some time to complete.
    name: msg-delete-ediscovery-case-hold-policy
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The policy ID that is intended to be updated.
      isArray: false
      name: hold_policy_id
      required: true
    - description: The description of the legal hold policy.
      isArray: false
      name: description
      required: false
    - description: KQL query specifying content to be held in the specified locations. Learn about KQL (https://learn.microsoft.com/en-us/kusto/query/?view=azure-data-explorer&preserve-view=true).
      isArray: false
      name: content_query
      required: false
    description: Update the properties of an ediscoveryHoldPolicy object.
    name: msg-update-ediscovery-case-hold-policy
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the legal hold policy.
      isArray: false
      name: hold_policy_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - description: Show all results if true.
      isArray: false
      name: all_results
      required: false
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
      auto: PREDEFINED
    description: Get a list of the ediscoveryHoldPolicy objects and their properties.
    name: msg-list-ediscovery-case-hold-policy
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.ID
      description: The ID of the eDiscovery hold policy.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.DisplayName
      description: The display name of the legal hold.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Description
      description: The legal hold description.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.ContentQuery
      description: KQL query that specifies content to be held. If empty, all content in the specified locations is held.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.IsEnabled
      description: Indicates whether the hold is enabled and actively holding content.
      type: Boolean
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Status
      description: The status of the legal hold. Possible values are Pending, Error, Success.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Errors
      description: Lists any errors that happened while placing the hold.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedDateTime
      description: The date and time the legal hold was created.
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedDateTime
      description: The date and time the legal hold was last modified.
      type: Date
    # --- createdBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
    # --- lastModifiedBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the operation.
      isArray: false
      name: operation_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - description: Show all results if true.
      isArray: false
      name: all_results
      required: false
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
      auto: PREDEFINED
    - description: 'Download the export report when an export file link is available. This only applies if `operation_id` is provided. For authorization or permission errors while downloading, see: https://learn.microsoft.com/en-us/graph/api/security-caseoperation-get?view=graph-rest-1.0&tabs=http#response-1'
      name: download_file
      isArray: false
      required: false
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
      auto: PREDEFINED
    description: Get a list of the caseOperation objects and their properties, or retrieve a specific operation by ID. When operation_id is provided, you can set download_file=true to download the export report (if available).
    name: msg-list-case-operation
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.Operation.ID
      description: The ID of the case operation. Read-only.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.Action
      description: >
        The type of action the operation represents (caseAction).
        Example values: contentExport, applyTags, convertToPdf, index, estimateStatistics,
        addToReviewSet, holdUpdate, purgeData, exportReport, exportResult, holdPolicySync.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.Status
      description: >
        The status of the case operation.
        Possible values: notStarted, submissionFailed, running, succeeded, partiallySucceeded, failed.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.PercentProgress
      description: The progress of the operation.
      type: Number
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedDateTime
      description: The date and time the operation was created.
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.Operation.CompletedDateTime
      description: The date and time the operation was completed.
      type: Date
    # --- createdBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.ResultInfo.Code
      description: The result code (2xx success, 4xx client error, 5xx server error).
      type: Number
    - contextPath: MsGraph.eDiscoveryCase.Operation.ResultInfo.Message
      description: The result message.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.ResultInfo.Subcode
      description: The result subcode.
      type: Number
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the search.
      isArray: false
      name: search_id
      required: true
    - description: The additional options for the export.
      isArray: false
      name: additional_options
      required: true
      auto: PREDEFINED
      predefined:
      - none
      - teamsAndYammerConversations
      - cloudAttachments
      - allDocumentVersions
      - subfolderContents
      - listAttachments
      - htmlTranscripts
      - advancedIndexing
      - allItemsInFolder
      - includeFolderAndPath
      - condensePaths
      - friendlyName
      - splitSource
      - includeReport
    - description: The portion of the estimate results to be exported.
      isArray: true
      name: export_criteria
      required: true
      auto: PREDEFINED
      predefined:
      - searchHits
      - partiallyIndexed
    - description: The desired format of the exported emails.
      isArray: false
      name: export_format
      required: true
      auto: PREDEFINED
      predefined:
      - pst
      - msg
    - description: The versions of cloud attachments to include in messages.
      isArray: false
      name: cloud_attachment_version
      required: false
      defaultValue: latest
      auto: PREDEFINED
      predefined:
      - latest
      - recent10
      - recent100
      - all
    - description: The description of the export result.
      isArray: false
      name: description
      required: false
    - description: The display name of the export result.
      isArray: false
      name: display_name
      required: true
    - description: The versions of files in SharePoint to include.
      isArray: false
      name: document_version
      required: false
      defaultValue: latest
      auto: PREDEFINED
      predefined:
      - latest
      - recent10
      - recent100
      - all
    - description: Location scope for partially indexed items. You can choose to include partially indexed items only in responsive locations with search hits or in all targeted locations.
      isArray: false
      name: export_location
      required: false
      auto: PREDEFINED
      predefined:
      - responsiveLocations
      - nonresponsiveLocations
    description: Export results from an estimated ediscoverySearch. For details, see Manage a collection estimate (https://learn.microsoft.com/en-us/purview/ediscovery-create-draft-collection#manage-a-collection-estimate).
    name: msg-export-result-ediscovery-data
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.Export.OperationID
      description: The ID of the export operation. Use this ID to retrieve the operation status via 'msg-list-case-operation'.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Export.CaseID
      description: The ID of the eDiscovery case the export belongs to.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Export.Location
      description: The Location header URL returned for the export operation.
      type: String
  dockerimage: demisto/crypto:1.0.0.10120494
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  feed: false
tests:
- Microsoft Graph Security Test dev
- Microsoft Graph Security Test prod
- Microsoft Graph Security Test dev v2
- Microsoft Graph Security Test prod v2
- Microsoft Graph Security Test self deployed v2
- MSG-ediscovery-tpb
- MSG-Threat-Assessment-test
fromversion: 5.0.0