Microsoft Graph

⚠️ Microsoft Graph Security Legacy Alerts Deprecation

Note: Microsoft has deprecated the Legacy Alerts API. As of April 10, 2026, the Legacy Alerts endpoint no longer returns data. This integration now exclusively uses the Alerts v2 API. For more details, see the Microsoft documentation.

Unified gateway to security insights - all from a unified Microsoft Graph Security API.
This integration was integrated and tested with version 1.0 of Microsoft Graph.

Authentication

For more details about the authentication used in this integration, see Microsoft Integrations - Authentication
Note: The eDiscovery and Threat Assessment commands are only supported when using the Authorization Code flow with Delegated (work or school account) permission type.

When using the Authorization Code flow for this integration, you should log in as an administrator or a user with administrative privileges (Security Reader or Security Administrator) after running the msg-generate-login-url command and the login window appears. For more information, see here.

Fetch Incidents and Alerts

Use the Fetch incidents type parameter to control what this integration ingests. You can select Alerts, Incidents, or both:

• Alerts - Each Microsoft Graph Security alert is fetched on its own.
• Incidents - Each Microsoft Graph Security incident is fetched on its own, with all of its associated alerts embedded within it (retrieved via $expand=alerts) and stored as raw JSON. This gives you one grouped incident that already contains its underlying alerts, instead of many separate alert incidents.

You can narrow what is fetched using the Alerts Filter and Incidents Filter parameters. These accept an OData $filter expression, for example severity eq 'medium' and status eq 'active'. For the supported syntax and operators, see Microsoft query parameters.

Important Notes

• Due to API limitations, the msg-search-alerts command does not filter Office 365 provider alerts.\
  For more information, see: https://github.com/microsoftgraph/security-api-solutions/issues/56.
• The following properties are supported as filters:
  • Alerts Filter parameter (and alert filter arguments): assignedTo, classification, determination, createdDateTime, lastUpdateDateTime, severity, serviceSource and status. See Microsoft optional alert query parameters.
  • Incidents Filter parameter: assignedTo, classification, createdDateTime, determination, lastUpdateDateTime, severity, and status. See Microsoft optional incident query parameters.
  • The filter should be provided as an OData $filter expression, for example severity eq 'medium' and status eq 'active'. For the general syntax and operators, see Microsoft query parameters.
• The header include-unknown-enum-members is used when fetching alerts. It ensures that fields with unknown values are correctly mapped to the appropriate service. Learn More.
• When using Threat Assessment, only the following properties are supported as filters for the filter parameter: expectedAssessment, ContentType, status and requestSource.
• When using Threat Assessment for information protection, the following limits apply to any request:
  • For email, the resource is a unique network message ID/recipient pair. For example, submitting an email with the same message ID sent to the same person multiple times in a 15 minutes period will trigger the limit per resource limits listed in the following table. However, you can submit up to 150 unique emails every 15 minutes (tenant limit).

  Operation	Limit per tenant	Limit per resource (email, URL, file)
  POST	150 requests per 15 minutes and 10000 requests per 24 hours.	1 request per 15 minutes and 3 requests per 24 hours.

Required Permissions

1. User.Read.All - Application (Only required if using the deprecated commands: msg-get-user and msg-get-users)
2. SecurityIncident.Read.All - Delegated or Application (required for the command msg-list-security-incident and Fetch Incidents)
3. SecurityIncident.ReadWrite.All - Delegated or Application (required for the command msg-update-security-incident and Fetch Incidents)
4. ThreatHunting.Read.All - Delegated or Application (required for the command msg-advanced-hunting)

Alerts:

1. SecurityAlert.Read.All - Application (required for the commands: msg-search-alerts and msg-get-alert-details)
2. SecurityAlert.ReadWrite.All - Application (required for updating alerts with the commands: msg-update-alert and msg-create-alert-comment)

eDiscovery:

1. eDiscovery.Read.All - Delegated (Required for the list-ediscovery commands)
2. eDiscovery.ReadWrite.All - Delegated (Required for the create/update/delete-ediscovery, msg-export-result-ediscovery-data commands)
3. eDiscovery.Download.Read - Delegated (Required for the msg-list-case-operation, download_file=True command)
   More information about defining this permission can be found here.

Threat Assessment:

1. Mail.Read.Shared - Delegated
2. ThreatAssessment.ReadWrite.All - Delegated
3. User.Read.All - Delegated

Configure Microsoft Graph Security on Cortex

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for Microsoft Graph Security.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   Azure Cloud	When selecting the Custom option, the Host URL parameter must be filled. More information about National clouds can be found here.	False
   Host URL	The host URL. When using this parameter, select the Custom option for the Azure Cloud. More information about National clouds can be found here.	False
   Application ID or Client ID	The app registration ID.	True
   Token or Tenant ID	The tenant ID.	True
   Key or Client Secret	The app registration secret.	False
   Authorization code	Get the authorization code from steps 3-5 in the self deployed authorization process.	False
   Application redirect URI (for self-deployed mode)	The app registration redirect URI.	False
   Certificate Thumbprint	Used for certificate authentication, as it appears in the “Certificates & secrets” page of the app.	False
   Private Key	Used for certificate authentication. The private key of the registered certificate.	False
   Use Azure Managed Identities	Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.	False
   Azure Managed Identities Client ID	The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.	False
   Trust any certificate (not secure)	Whether to trust any certificate. If True, not secure.	False
   Use system proxy settings	Whether to use system proxy settings.	False
   Use a self-deployed Azure application	Whether to use a self-deployed application.	False
   Fetch incidents	Whether to fetch incidents.	False
   Incident type	The incident type to apply.	False
   First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)	<number> <time unit>, for example 1 hour, 30 minutes.	False
   Fetch limit per type	The maximum number of items to fetch per type. Applies to both alerts and incidents. Note that when fetching incidents, no more than 50 can be fetched per cycle, due to a Microsoft limitation.	False
   Fetch incidents type	Select which record types to fetch. You can select Alerts, Incidents, or both.	False
   Alerts Service Sources	Relevant only when fetching Alerts (incidents have no service source). Multiple serviceSource values can be provided, separated by commas, for example “microsoftDefenderForEndpoint,microsoftCloudAppSecurity”. If empty, alerts of all service sources will be fetched.	False
   Alerts Filter	Use this field to filter fetched alerts according to their properties. Applies only when fetching Alerts. Overrides the service sources list, if given. Filter should be in the format “{property} eq ‘{property-value}’”. Multiple filters can be applied separated with “ and “, for example “createdDateTime eq YYYY-MM-DD and severity eq ‘high’”.	False
   Incidents Filter	Use this field to filter fetched incidents according to their properties. Applies only when fetching Incidents. Filter should be in the format “{property} eq ‘{property-value}’”. Multiple filters can be applied separated with “ and “, for example “severity eq ‘high’ and status eq ‘active’”.	False
   Microsoft 365 Defender context	When selected, the hunting query result is also saved to the Microsoft 365 Defender context path. Relevant only for the msg-advanced-hunting command.	False

4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msg-auth-test

Tests connectivity to Microsoft Graph Security.

Base Command

msg-auth-test

Input

Context Output

There is no context output for this command.

Command example

!msg-auth-test permission_type=ediscovery

Human Readable Output

Authentication was successful.

msg-search-alerts

List alerts (security issues) within a customer’s tenant that Microsoft or partner security solutions have identified.

Base Command

msg-search-alerts

Input

Context Output

Human Readable Output

Microsoft Security Graph Alerts

ID	IncidentId	Status	Severity	DetectionSource	ServiceSource	Title	Category	CreatedDate	LastUpdateDateTime
id		new	medium	customTi	microsoftDefenderForEndpoint	test alert	None	2022-10-03T03:39:21.7562976Z	2023-04-17T11:01:31.7566667Z

msg-get-alert-details

Get details for a specific alert.

Base Command

msg-get-alert-details

Input

Context Output

Human Readable Output

Microsoft Security Graph Alert Details -

ID	IncidentId	Status	Severity	DetectionSource	ServiceSource	Title	Category	CreatedDate	LastUpdateDateTime
		new	medium	customTi	microsoftDefenderForEndpoint	test alert	None	2022-10-03T03:39:21.7562976Z	2023-04-17T11:01:31.7566667Z

msg-update-alert

Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions using its reference ID.

Base Command

msg-update-alert

Input

Context Output

Human Readable Output

Alert has been successfully updated.

msg-create-alert-comment

Create a comment for an existing alert.

Base Command

msg-create-alert-comment

Input

Context Output

Human Readable Output

Microsoft Security Graph Create Alert Comment -

comment	createdByDisplayName	createdDate
comment	Cortex XSOAR MS Graph Dev	2023-04-17T10:57:18.5231438Z
comment	Cortex XSOAR MS Graph Dev	2023-04-17T11:01:31.7427859Z
comment	Cortex XSOAR MS Graph Dev	2023-04-17T13:30:22.3995128Z

ms-graph-security-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

ms-graph-security-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

eDiscovery Commands

msg-list-ediscovery-cases

Lists edicovery cases.

Base Command

msg-list-ediscovery-cases

Input

Context Output

Command example

!msg-list-ediscovery-cases limit=5

Context Example

{
    "MsGraph": {
        "eDiscoveryCase": [
            {
                "CaseId": "06386565-47d4-410b-96f9-007978319c02",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-18T10:55:12.63Z",
                "Description": "",
                "DisplayName": "a",
                "ExternalId": "123",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-20T12:25:05.797Z"
            },
            {
                "CaseId": "44bbe68b-0da1-42b4-9ad0-00e8b52f64e2",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-18T11:59:33.44Z",
                "Description": "",
                "DisplayName": "asassdda",
                "ExternalId": "",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-18T11:59:33.44Z"
            },
            {
                "CaseId": "f108b7fa-d177-438e-9679-01cd79e3df3f",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-20T07:08:01.95Z",
                "Description": "wrking",
                "DisplayName": "justw orkok?",
                "ExternalId": "",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-20T07:08:01.95Z"
            },
            {
                "CaseId": "f346c6f5-1d66-4fab-a46b-0abc99c2cef0",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-18T11:54:59.873Z",
                "Description": "",
                "DisplayName": "asasdda",
                "ExternalId": "",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-18T11:54:59.873Z"
            },
            {
                "CaseId": "1a346a94-5220-46ae-a821-0bbbadf4009d",
                "CaseStatus": "active",
                "ClosedBy": {
                    "User": {
                        "DisplayName": ""
                    }
                },
                "CreatedDateTime": "2023-06-12T07:05:27.557Z",
                "Description": "Test Case 104 description",
                "DisplayName": "Test Case 104",
                "ExternalId": "",
                "LastModifiedBy": {
                    "User": {
                        "DisplayName": "Content Test"
                    }
                },
                "LastModifiedDateTime": "2023-06-12T07:05:27.557Z"
            }
        ]
    }
}

Human Readable Output

Results

Display Name	Description	External Id	Case Status	Case Id	Created Date Time	Last Modified Date Time	Last Modified By Name
a		123	active	06386565-47d4-410b-96f9-007978319c02	2023-06-18T10:55:12.63Z	2023-06-20T12:25:05.797Z	Content Test
asassdda			active	44bbe68b-0da1-42b4-9ad0-00e8b52f64e2	2023-06-18T11:59:33.44Z	2023-06-18T11:59:33.44Z	Content Test
justw orkok?	wrking		active	f108b7fa-d177-438e-9679-01cd79e3df3f	2023-06-20T07:08:01.95Z	2023-06-20T07:08:01.95Z	Content Test
asasdda			active	f346c6f5-1d66-4fab-a46b-0abc99c2cef0	2023-06-18T11:54:59.873Z	2023-06-18T11:54:59.873Z	Content Test
Test Case 104	Test Case 104 description		active	1a346a94-5220-46ae-a821-0bbbadf4009d	2023-06-12T07:05:27.557Z	2023-06-12T07:05:27.557Z	Content Test

msg-create-ediscovery-case

Create a new eDiscovery case. This command only creates an eDiscovery (Premium) case using the new case format. To learn more about the new case format in eDiscovery, see https://learn.microsoft.com/en-us/microsoft-365/compliance/advanced-ediscovery-new-case-format.

Base Command

msg-create-ediscovery-case

Input

Context Output

Command example

!msg-create-ediscovery-case display_name=`my case name11234` external_id=123 description=`description of the case`

Context Example

{
    "MsGraph": {
        "eDiscoveryCase": {
            "CaseId": "6dfd17fe-43c5-411f-a194-abdc9492bfa0",
            "CaseStatus": "active",
            "CreatedDateTime": "2023-07-06T07:42:34.897Z",
            "Description": "description of the case",
            "DisplayName": "my case name11234",
            "ExternalId": "123",
            "LastModifiedDateTime": "2023-07-06T07:42:34.897Z"
        }
    }
}

Human Readable Output

Results

Display Name	Description	External Id	Case Status	Case Id	Created Date Time	Last Modified Date Time
my case name11234	description of the case	123	active	6dfd17fe-43c5-411f-a194-abdc9492bfa0	2023-07-06T07:42:34.897Z	2023-07-06T07:42:34.897Z

msg-update-ediscovery-case

Update an eDiscovery case.

Base Command

msg-update-ediscovery-case

Input

Context Output

There is no context output for this command.

Command example

!msg-update-ediscovery-case case_id=6dfd17fe-43c5-411f-a194-abdc9492bfa0 display_name=`new display name` external_id=123 description=`new description of the case`

Human Readable Output

Case with id 6dfd17fe-43c5-411f-a194-abdc9492bfa0 was updated successfully.

msg-close-ediscovery-case

Close an eDiscovery case.
When the legal case or investigation supported by a eDiscovery (Standard) case is completed, you can close the case. Here’s what happens when you close a case:
If the case contains any eDiscovery holds, they’ll be turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This helps prevent content from being immediately deleted and provides admins the opportunity to search for and restore content before it may be permanently deleted after the delay hold period expires. For more information, see Removing content locations from an eDiscovery hold.
Closing a case only turns off the holds that are associated with that case. If other holds are placed on a content location (such as a Litigation Hold, a retention policy, or a hold from a different eDiscovery (Standard) case) those holds will still be maintained.
The case is still listed on the eDiscovery (Standard) page in the Microsoft Purview compliance portal. The details, holds, searches, and members of a closed case are retained.
You can edit a case after it’s closed. For example, you can add or remove members, create searches, and export search results. The primary difference between active and closed cases is that eDiscovery holds are turned off when a case is closed.

Base Command

msg-close-ediscovery-case

Input

Context Output

There is no context output for this command.

Command example

!msg-close-ediscovery-case case_id=6dfd17fe-43c5-411f-a194-abdc9492bfa0

Human Readable Output

Case with id 6dfd17fe-43c5-411f-a194-abdc9492bfa0 was closed successfully.

msg-reopen-ediscovery-case

Reopen an eDiscovery case. When you reopen an eDiscovery (Premium) case, any holds that were in place when the case was closed won’t be automatically reinstated. After the case is reopened, you’ll have to go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, and then set the Status toggle to On.

Base Command

msg-reopen-ediscovery-case

Input

Context Output

There is no context output for this command.

Command example

!msg-reopen-ediscovery-case case_id=6dfd17fe-43c5-411f-a194-abdc9492bfa0

Human Readable Output

Case with id 6dfd17fe-43c5-411f-a194-abdc9492bfa0 was reopened successfully.

msg-delete-ediscovery-case

Delete an eDiscovery case. Before you can delete a case, you must first delete all holds listed on the holds page of the case. That includes deleting holds with a status of Off. Default hold policies can only be deleted when the hold is turned off. You must close an active case to turn off any default hold policies in the case. Once the holds are turned off for default hold policies, they can be deleted.

Base Command

msg-delete-ediscovery-case

Input

Context Output

There is no context output for this command.

Command example

!msg-delete-ediscovery-case case_id=6dfd17fe-43c5-411f-a194-abdc9492bfa0

Human Readable Output

Case was deleted successfully.

msg-create-ediscovery-custodian

Create a new ediscoveryCustodian object. After the custodian object is created, you will need to create the custodian’s userSource to reference their mailbox and OneDrive for Business site.

Base Command

msg-create-ediscovery-custodian

Input

Context Output

Command example

!msg-create-ediscovery-custodian case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 email=testbox2@yoursite.onmicrosoft.com

Context Example

{
    "MsGraph": {
        "eDiscoveryCustodian": {
            "CreatedDateTime": "2023-07-06T07:53:36.9441479Z",
            "CustodianId": "0af7ca2b84bc4cff930d5d301cc4caf3",
            "CustodianStatus": "active",
            "DisplayName": "testbox2",
            "Email": "yourmail@yoursite.onmicrosoft.com",
            "HoldStatus": "notApplied",
            "LastModifiedDateTime": "2023-07-06T07:53:36.9441479Z"
        }
    }
}

Human Readable Output

Results

Display Name	Email	Custodian Status	Custodian Id	Created Date Time	Last Modified Date Time	Hold Status
testbox2	yourmail@yoursite.onmicrosoft.com	active	0af7ca2b84bc4cff930d5d301cc4caf3	2023-07-06T07:53:36.9441479Z	2023-07-06T07:53:36.9441479Z	notApplied

msg-list-ediscovery-custodians

List custodians on a given eDiscovery case.

Base Command

msg-list-ediscovery-custodians

Input

Context Output

Command example

!msg-list-ediscovery-custodians all_results=true case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Context Example

{
    "MsGraph": {
        "eDiscoveryCustodian": {
            "CreatedDateTime": "2023-07-06T07:53:36.9441479Z",
            "CustodianId": "0af7ca2b84bc4cff930d5d301cc4caf3",
            "CustodianStatus": "active",
            "DisplayName": "testbox2",
            "Email": "mail@yoursite.onmicrosoft.com",
            "HoldStatus": "notApplied",
            "LastModifiedDateTime": "2023-07-06T07:53:36.9441479Z"
        }
    }
}

Human Readable Output

Results

Display Name	Email	Custodian Status	Custodian Id	Created Date Time	Last Modified Date Time	Hold Status
testbox2	mail@yoursite.onmicrosoft.com	active	0af7ca2b84bc4cff930d5d301cc4caf3	2023-07-06T07:53:36.9441479Z	2023-07-06T07:53:36.9441479Z	notApplied

msg-activate-ediscovery-custodian

Activate a custodian that has been released from a case to make them part of the case again. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery-manage-new-custodians?view=o365-worldwide#re-activate-custodian.

Base Command

msg-activate-ediscovery-custodian

Input

Context Output

There is no context output for this command.

Command example

!msg-activate-ediscovery-custodian custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Human Readable Output

Custodian with id 0af7ca2b84bc4cff930d5d301cc4caf3 Case was reactivated on case with id 84abfff1-dd69-4559-8f4e-8225e0d505c5 successfully.

msg-release-ediscovery-custodian

Release a custodian from a case. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/manage-new-custodians#release-a-custodian-from-a-case.

Base Command

msg-release-ediscovery-custodian

Input

Context Output

There is no context output for this command.

Command example

!msg-release-ediscovery-custodian custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Human Readable Output

Custodian with id 0af7ca2b84bc4cff930d5d301cc4caf3 was released from case with id 84abfff1-dd69-4559-8f4e-8225e0d505c5 successfully.

msg-create-ediscovery-custodian-site-source

Create a new siteSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

Base Command

msg-create-ediscovery-custodian-site-source

Input

Context Output

Command example

!msg-create-ediscovery-custodian-site-source custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 site=https://yourdev.sharepoint.com/sites/site_test_1

Context Example

{
    "MsGraph": {
        "CustodianSiteSource": {
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "0001-01-01T00:00:00Z",
            "DisplayName": "site_test_1",
            "HoldStatus": "notApplied",
            "SiteSourceId": "862f0a64-e7db-46e0-a97f-9156b4f693ee"
        }
    }
}

Human Readable Output

Results

Display Name	Site Source Id	Hold Status	Created Date Time	Created By Name	Created By UPN	Created By App Name
site_test_1	862f0a64-e7db-46e0-a97f-9156b4f693ee	notApplied	0001-01-01T00:00:00Z	Content Test	ContentTest@yoursite.onmicrosoft.com	Cortex XSOAR - MS Graph Security Dev

msg-create-ediscovery-custodian-user-source

Create a new userSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

Base Command

msg-create-ediscovery-custodian-user-source

Input

Context Output

Command example

!msg-create-ediscovery-custodian-user-source custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 email=testbox2@yoursite.onmicrosoft.com included_sources="mailbox, site"

Context Example

{
    "MsGraph": {
        "CustodianUserSource": {
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "0001-01-01T00:00:00Z",
            "DisplayName": "testbox2",
            "Email": "testbox2@yoursite.onmicrosoft.com",
            "HoldStatus": "notApplied",
            "IncludedSources": "mailbox,site",
            "UserSourceId": "0af7ca2b-84bc-4cff-930d-5d301cc4caf3"
        }
    }
}

Human Readable Output

Results

Display Name	Email	User Source Id	Hold Status	Created Date Time	Created By Name	Created By UPN	Created By App Name	Included Sources
testbox2	testbox2@yoursite.onmicrosoft.com	0af7ca2b-84bc-4cff-930d-5d301cc4caf3	notApplied	0001-01-01T00:00:00Z	Content Test	ContentTest@yoursite.onmicrosoft.com	Cortex XSOAR - MS Graph Security Dev	mailbox,site

msg-list-ediscovery-custodian-user-sources

Get a list of the userSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

Base Command

msg-list-ediscovery-custodian-user-sources

Input

Context Output

Command example

!msg-list-ediscovery-custodian-user-sources custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Context Example

{
    "MsGraph": {
        "CustodianUserSource": {
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "2023-07-06T08:04:21.1548801Z",
            "DisplayName": "testbox2",
            "Email": "testbox2@yoursite.onmicrosoft.com",
            "HoldStatus": "notApplied",
            "IncludedSources": "mailbox,site",
            "SiteWebUrl": "https://yourdev-my.sharepoint.com/personal/testbox2_yourdev_onmicrosoft_com",
            "UserSourceId": "0af7ca2b-84bc-4cff-930d-5d301cc4caf3"
        }
    }
}

Human Readable Output

Results

Display Name	Email	User Source Id	Hold Status	Created Date Time	Created By Name	Created By UPN	Created By App Name	Site Web Url	Included Sources
testbox2	testbox2@yoursite.onmicrosoft.com	0af7ca2b-84bc-4cff-930d-5d301cc4caf3	notApplied	2023-07-06T08:04:21.1548801Z	Content Test	ContentTest@yoursite.onmicrosoft.com	Cortex XSOAR - MS Graph Security Dev	https://yourdev-my.sharepoint.com/personal/testbox2_yourdev_onmicrosoft_com	mailbox,site

msg-list-ediscovery-custodian-site-sources

Get a list of the siteSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.

Base Command

msg-list-ediscovery-custodian-site-sources

Input

Context Output

Command example

!msg-list-ediscovery-custodian-site-sources custodian_id=0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 site_source_id=862f0a64-e7db-46e0-a97f-9156b4f693ee

Context Example

{
    "MsGraph": {
        "CustodianSiteSource": {
            "CreatedBy": {
                "User": {
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b"
                }
            },
            "CreatedDateTime": "2023-07-06T08:02:28.5670187Z",
            "DisplayName": "site_test_1",
            "HoldStatus": "removing",
            "Site": {
                "CreatedDate": "2023-07-06T08:02:28.5670187Z",
                "ID": "862f0a64-e7db-46e0-a97f-9156b4f693ee",
                "WebUrl": "https://yourdev.sharepoint.com/sites/site_test_1"
            },
            "SiteSourceId": "862f0a64-e7db-46e0-a97f-9156b4f693ee"
        }
    }
}

Human Readable Output

Results

Display Name	Site Source Id	Hold Status	Created Date Time
site_test_1	862f0a64-e7db-46e0-a97f-9156b4f693ee	removing	2023-07-06T08:02:28.5670187Z

msg-apply-hold-ediscovery-custodian

Start the process of applying hold on eDiscovery custodians.
Available return statuses:
notApplied - The custodian is not on hold (all sources in it are not on hold).
applied - The custodian is on hold (all sources are on hold).
applying - The custodian is in applying hold state (applyHold operation triggered).
removing - The custodian is in removing the hold state(removeHold operation triggered).
partial - The custodian is in mixed state where some sources are on hold and some not on hold or error state.

Base Command

msg-apply-hold-ediscovery-custodian

Input

Context Output

There is no context output for this command.

Command example

!msg-apply-hold-ediscovery-custodian custodian_id=09f05c43ffc54ff88cf5c5e89699375d,0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Human Readable Output

Apply hold status is running.

msg-remove-hold-ediscovery-custodian

Start the process of removing hold from eDiscovery custodians.

Base Command

msg-remove-hold-ediscovery-custodian

Input

Context Output

There is no context output for this command.

Command example

!msg-remove-hold-ediscovery-custodian custodian_id=09f05c43ffc54ff88cf5c5e89699375d,0af7ca2b84bc4cff930d5d301cc4caf3 case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Human Readable Output

Remove hold status is running.

msg-create-ediscovery-non-custodial-data-source

Create a new eDiscoveryNoncustodialDataSource object.

Base Command

msg-create-ediscovery-non-custodial-data-source

Input

Context Output

Command example

!msg-create-ediscovery-non-custodial-data-source case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 site=https://yourdev.sharepoint.com/sites/site_test_1

Context Example

{
    "MsGraph": {
        "NoncustodialDataSource": {
            "CreatedDateTime": "2023-07-06T08:22:32.3121523Z",
            "DataSourceId": "38394332433939353236344630434633",
            "DataSourceStatus": "active",
            "DisplayName": "site_test_1",
            "HoldStatus": "notApplied",
            "LastModifiedDateTime": "2023-07-06T08:22:32.3121523Z",
            "ReleasedDateTime": "0001-01-01T00:00:00Z"
        }
    }
}

Human Readable Output

Results

Created Date Time	Data Source Id	Data Source Status	Display Name	Hold Status	Last Modified Date Time	Released Date Time
2023-07-06T08:22:32.3121523Z	38394332433939353236344630434633	active	site_test_1	notApplied	2023-07-06T08:22:32.3121523Z	0001-01-01T00:00:00Z

msg-list-ediscovery-non-custodial-data-sources

Get a list of the non-custodial data sources and their properties.

Base Command

msg-list-ediscovery-non-custodial-data-sources

Input

Context Output

Command example

!msg-list-ediscovery-non-custodial-data-sources case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Context Example

{
    "MsGraph": {
        "NoncustodialDataSource": {
            "CreatedDateTime": "2023-07-06T08:22:32.3121523Z",
            "DataSourceId": "38394332433939353236344630434633",
            "DisplayName": "site_test_1",
            "HoldStatus": "notApplied",
            "LastModifiedDateTime": "2023-07-06T08:22:32.3121523Z",
            "ReleasedDateTime": "0001-01-01T00:00:00Z",
            "Status": "active"
        }
    }
}

Human Readable Output

Results

Display Name	Data Source Id	Hold Status	Created Date Time	Last Modified Date Time	Released Date Time	Status
site_test_1	38394332433939353236344630434633	notApplied	2023-07-06T08:22:32.3121523Z	2023-07-06T08:22:32.3121523Z	0001-01-01T00:00:00Z	active

msg-create-ediscovery-search

Create a new eDiscoverySearch object.

Base Command

msg-create-ediscovery-search

Input

Context Output

Command example

!msg-create-ediscovery-search case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 display_name=`my search` data_source_scopes=allCaseNoncustodialDataSources

Context Example

{
    "MsGraph": {
        "eDiscoverySearch": {
            "ContentQuery": "",
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "2023-07-06T08:25:36.9874937Z",
            "DataSourceScopes": "allCaseNoncustodialDataSources",
            "Description": "",
            "DisplayName": "my search",
            "LastModifiedDateTime": "2023-07-06T08:25:36.9874937Z",
            "SearchId": "e7282eff-ba81-43cb-9027-522a343f6692"
        }
    }
}

Human Readable Output

Results

Display Name	Data Source Scopes	Search Id	Created By Name	Created By App Name	Created By UPN	Created Date Time	Last Modified Date Time
my search	allCaseNoncustodialDataSources	e7282eff-ba81-43cb-9027-522a343f6692	Content Test	Cortex XSOAR - MS Graph Security Dev	ContentTest@yoursite.onmicrosoft.com	2023-07-06T08:25:36.9874937Z	2023-07-06T08:25:36.9874937Z

msg-update-ediscovery-search

Update an eDiscoverySearch object.

Base Command

msg-update-ediscovery-search

Input

Context Output

There is no context output for this command.

Command example

!msg-update-ediscovery-search case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 display_name=newname search_id=e7282eff-ba81-43cb-9027-522a343f6692

Human Readable Output

eDiscovery search e7282eff-ba81-43cb-9027-522a343f6692 was updated successfully.

msg-list-ediscovery-searchs

Get the list of eDiscoverySearch resources from an eDiscovery case.

Base Command

msg-list-ediscovery-searchs

Input

Context Output

Command example

!msg-list-ediscovery-searchs case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5

Context Example

{
    "MsGraph": {
        "eDiscoverySearch": {
            "ContentQuery": "",
            "CreatedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "CreatedDateTime": "2023-07-06T08:25:36.9874937Z",
            "DataSourceScopes": "allCaseNoncustodialDataSources",
            "Description": "",
            "DisplayName": "newname",
            "LastModifiedBy": {
                "Application": {
                    "DisplayName": "Cortex XSOAR - MS Graph Security Dev",
                    "ID": "734f96d8-b19c-4ab1-9382-e04aa9a5debd"
                },
                "User": {
                    "DisplayName": "Content Test",
                    "ID": "38c41451-94b8-44cc-8c02-649208c43b6b",
                    "UserPrincipalName": "ContentTest@yoursite.onmicrosoft.com"
                }
            },
            "LastModifiedDateTime": "2023-07-06T08:27:51.5611704Z",
            "SearchId": "e7282eff-ba81-43cb-9027-522a343f6692"
        }
    }
}

Human Readable Output

Results

Display Name	Data Source Scopes	Search Id	Created By Name	Created By App Name	Created By UPN	Created Date Time	Last Modified Date Time
newname	allCaseNoncustodialDataSources	e7282eff-ba81-43cb-9027-522a343f6692	Content Test	Cortex XSOAR - MS Graph Security Dev	ContentTest@yoursite.onmicrosoft.com	2023-07-06T08:25:36.9874937Z	2023-07-06T08:27:51.5611704Z

msg-purge-ediscovery-data

Deletes mailbox items in Exchange or messages in Microsoft Teams that are included in an eDiscovery search.

You can collect and purge the following categories of Teams content:

Teams 1:1 chats - Chat messages, posts, and attachments shared in a Teams conversation between two people. Teams 1:1 chats are also called conversations.
Teams group chats - Chat messages, posts, and attachments shared in a Teams conversation between three or more people. Also called 1:N chats or group conversations.
Teams channels - Chat messages, posts, replies, and attachments shared in a standard Teams channel.
Private channels - Message posts, replies, and attachments shared in a private Teams channel.
Shared channels - Message posts, replies, and attachments shared in a shared Teams channel.

Base Command

msg-purge-ediscovery-data

Input

Context Output

Command example

!msg-purge-ediscovery-data case_id=00000000-0000-0000-0000-000000000000 search_id=11111111-1111-1111-1111-111111111111 purge_type=permanentlyDelete purge_areas=mailboxes

Context Example

{
    "MsGraph": {
        "eDiscoveryCase": {
            "Purge": {
                "OperationID": "example-operation-id",
                "Status": "succeeded"
            }
        }
    }
}

Human Readable Output

eDiscovery purge status is succeeded.

• Operation ID: example-operation-id

msg-delete-ediscovery-search

Delete an eDiscoverySearch object.

Base Command

msg-delete-ediscovery-search

Input

Context Output

There is no context output for this command.

Command example

!msg-delete-ediscovery-search case_id=84abfff1-dd69-4559-8f4e-8225e0d505c5 search_id=e7282eff-ba81-43cb-9027-522a343f6692

Human Readable Output

eDiscovery search e7282eff-ba81-43cb-9027-522a343f6692 was deleted successfully.

Threat Assessment Commands

msg-create-mail-assessment-request

Create and retrieve a mail threat assessment.

Note:

• The message given in the command’s argument message_id has to contain X-MS-Exchange-Organization-Network-Message-Id header in the message or in the X-MS-Office365-Filtering-Correlation-Id header in quarantined messages.

• Delegated Mail permissions (Mail.Read or Mail.Read.Shared) are required to access the mail received by the user (recipient email and message user), which means that if the authenticated user is different from the user specified in the recipient_email and message_user, then Read and manage permissions on behalf of the given user need to be added for the authenticated user via Microsoft 365 admin center.

  • Go to Microsoft 365 admin center.
  • Choose the user email which will be provided in the command’s arguments.
  • Click on Manage product licenses.
  • Go to Mail.
  • Under Mailbox permissions, click on Read and manage permissions.
  • click on Add permissions.
  • Choose the authenticated user email from the list of given users.
  • Click on add.

Base Command

msg-create-mail-assessment-request

Input

Context Output

Command example

!msg-create-mail-assessment-request recipient_email="avishai@demistodev.onmicrosoft.com" expectedAssessment=unblock category=spam user_id=3fa9f28b-eb0e-463a-ba7b-8089fe9991e2 user_message=AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NmZhLWQ5MGY1YjIyNzBkNABGAAAAAACYCKjWAnXBTrnhgWJCcLX7BwDrxRwRjq-zTrN6vWSzK4OWAAAAAAEJAADrxRwRjq-zTrN6vWSzK4OWAAY5aBb-AAA=

Context Example

{

    "id": "11922306-b25b-4605-ff0d-08d772fcf996",
    "createdDateTime": "2019-11-27T05:45:14.0962061Z",
    "contentType": "mail",
    "expectedAssessment": "unblock",
    "category": "spam",
    "status": "completed",
    "requestSource": "administrator",
    "recipientEmail": "avishai@demistodev.onmicrosoft.com",
    "destinationRoutingReason": "notJunk",
    "messageUri": "",
    "createdBy": {
      "user": {
        "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
        "displayName": "Ronald Admin"
      }
    },
    "results": [
        {
            "id": "63798129-a62c-4f9e-2c6d-08d772fcfb0e",
            "createdDateTime": "2019-11-27T05:45:16.55Z",
            "resultType": "checkPolicy",
            "message": "No policy was hit."
        },
        {
            "id": "d38c2448-79eb-467e-2495-08d772fdb7d1",
            "createdDateTime": "2019-11-27T05:50:33.243Z",
            "resultType": "rescan",
            "message": "Not Spam"
        }
    ]
}

Human Readable Output

Mail assessment request

ID	Created DateTime	Content Type	Expected Assessment	Category	Status	Request Source	Recipient Email	Destination Routing Reason	Created User ID	Created Username
11922306-b25b-4605-ff0d-08d772fcf996	“2019-11-27T05:45:14.0962061Z”	mail	unblock	spam	completed	administrator	avishai@demistodev.onmicrosoft.com	notJunk	63798129-a62c-4f9e-2c6d-08d772fcfb0e	No policy was hit.

msg-create-email-file-assessment-request

Create and retrieve an email file threat assessment.

Note: File has to contain X-MS-Exchange-Organization-Network-Message-Id header in the message or in the X-MS-Office365-Filtering-Correlation-Id header in quarantined messages.

Base Command

msg-create-email-file-assessment-request

Input

Context Output

Command example

!msg-create-email-file-assessment-request recipient_email="avishai@demistodev.onmicrosoft.com" expectedAssessment=unblock category=phishing entry_id=12359704829584

Context Example

{

    "id": "76598306-b25b-4605-ff0d-03kgmtfcf996",
    "createdDateTime": "2019-11-27T05:45:14.0962061Z",
    "contentType": "mail",
    "expectedAssessment": "unblock",
    "category": "phishing",
    "status": "completed",
    "requestSource": "administrator",
    "recipientEmail": "avishai@demistodev.onmicrosoft.com",
    "destinationRoutingReason": "notJunk",
    "createdBy": {
      "user": {
        "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
        "displayName": "Ronald Admin"
      }
    },
    "results": [
        {
            "id": "63798129-a62c-4f9e-2c6d-08d772fcfb0e",
            "createdDateTime": "2019-11-27T05:45:16.55Z",
            "resultType": "checkPolicy",
            "message": "Phishing attempt."
        }
    ]
}

Human Readable Output

Mail assessment request

ID	Created DateTime	Content Type	Expected Assessment	Category	Status	Request Source	Recipient Email	Destination Routing Reason	Created User ID	Created Username
76598306-b25b-4605-ff0d-03kgmtfcf996	“2019-11-27T05:45:14.0962061Z”	mail	unblock	phishing	completed	administrator	avishai@demistodev.onmicrosoft.com	notJunk	63798129-a62c-4f9e-2c6d-08d772fcfb0e	Phishing attempt.

msg-create-file-assessment-request

Create and retrieve a file threat assessment.

Base Command

msg-create-file-assessment-request

Input

Context Output

Command example

!msg-create-file-assessment-request file_name="test_file.txt" expectedAssessment=block category=phishing entry_id=1235970482958bkf4

Context Example

{

    "id": "0796306-b456-4605-ff0d-03kgmtfcf876",
    "createdDateTime": "2019-11-27T05:45:14.0962061Z",
    "contentType": "file",
    "expectedAssessment": "block",
    "category": "phishing",
    "status": "completed",
    "requestSource": "administrator",
    "fileName": "test_file.txt",
    "createdBy": {
      "user": {
        "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
        "displayName": "Ronald Admin"
      }
    },
    "results": [
        {
            "id": "63798129-a62c-4f9e-2c6d-08d772fcfb0e",
            "createdDateTime": "2019-11-27T05:45:16.55Z",
            "resultType": "checkPolicy",
            "message": "Phishing attempt."
        }
    ]
}

Human Readable Output

Mail assessment request

ID	Created DateTime	Content Type	Expected Assessment	Category	Status	Request Source	File Name	Created User ID	Created Username
0796306-b456-4605-ff0d-03kgmtfcf876	“2019-11-27T05:45:14.0962061Z”	file	block	phishing	completed	administrator	test_file.txt	63798129-a62c-4f9e-2c6d-08d772fcfb0e	Phishing attempt.

msg-create-url-assessment-request

Create and retrieve url threat assessment.

Base Command

msg-create-url-assessment-request

Input

Context Output

Command example

!msg-create-url-assessment-request url="httpp://support.clean-mx.de/clean-mx/viruses.php" expectedAssessment=block category=malware

Context Example

{

    "id": "0796306-b456-4605-ff0d-03okmtgcf876",
    "createdDateTime": "2019-11-27T05:45:14.0962061Z",
    "contentType": "url",
    "expectedAssessment": "block",
    "category": "malware",
    "status": "completed",
    "requestSource": "administrator",
    "url": "httpp://support.clean-mx.de/clean-mx/viruses.php",
    "createdBy": {
      "user": {
        "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
        "displayName": "Ronald Admin"
      }
    },
    "results": [
        {
            "id": "63798129-a62c-4f9e-2c6d-08d772fcfb0e",
            "createdDateTime": "2019-11-27T05:45:16.55Z",
            "resultType": "checkPolicy",
            "message": "Malware attempt."
        }
    ]
}

Human Readable Output

Mail assessment request

ID	Created DateTime	Content Type	Expected Assessment	Category	Status	Request Source	URL	Created User ID	Created Username
0796306-b456-4605-ff0d-03okmtgcf876	“2019-11-27T05:45:14.0962061Z”	url	block	malware	completed	administrator	httpp://support.clean-mx.de/clean-mx/viruses.php	63798129-a62c-4f9e-2c6d-08d772fcfb0e	Malware attempt.

msg-list-threat-assessment-requests

Retrieve all threat assessment requests.

Base Command

msg-list-threat-assessment-requests

Input

Context Output

Command example

#### Context Example

```json
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#informationProtection/threatAssessmentRequests",
  "@odata.nextLink": "https://graph.microsoft.com/v1.0/informationProtection/threatAssessmentRequests?$skiptoken=eyJQYWdlQ29va2llIjoiPHJvdyBpZF9JZGVudGl0",
  "value": [
    {
      "@odata.type": "#microsoft.graph.mailAssessmentRequest",
      "id": "49c5ef5b-1f65-444a-e6b9-08d772ea2059",
      "createdDateTime": "2019-11-27T03:30:18.6890937Z",
      "contentType": "mail",
      "expectedAssessment": "block",
      "category": "spam",
      "status": "pending",
      "requestSource": "administrator",
      "recipientEmail": "avishaibrandies@microsoft.com",
      "destinationRoutingReason": "notJunk",
      "messageUri": "https://graph.microsoft.com/v1.0/users/c52ce8db-3e4b-4181-93c4-7d6b6bffaf60/messages/AAMkADU3MWUxOTU0LWNlOTEt=",
      "createdBy": {
        "user": {
          "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
          "displayName": "Ronald Admin"
        }
      }
    },
    {
      "@odata.type": "#microsoft.graph.emailFileAssessmentRequest",
      "id": "ab2ad9b3-2213-4091-ae0c-08d76ddbcacf",
      "createdDateTime": "2019-11-20T17:05:06.4088076Z",
      "contentType": "mail",
      "expectedAssessment": "block",
      "category": "malware",
      "status": "completed",
      "requestSource": "administrator",
      "recipientEmail": "tifc@a830edad9050849EQTPWBJZXODQ.onmicrosoft.com",
      "destinationRoutingReason": "notJunk",
      "contentData": "",
      "createdBy": {
        "user": {
          "id": "c52ce8db-3e4b-4181-93c4-7d6b6bffaf60",
          "displayName": "Ronald Admin"
        }
      }
    }
  ]
}

Human Readable Output

###Next Token is: eyJQYWdlQ29va2llIjoiPHJvdyBpZF9JZGVudGl

Mail assessment request

ID	Created DateTime	Content Type	Expected Assessment	Category	Status	Request Source	Recipient Email	Created User ID	Created Username	destinationRoutingReason
49c5ef5b-1f65-444a-e6b9-08d772ea2059	“2019-11-27T03:30:18.6890937Z”	mail	block	spam	pending	administrator	avishaibrandies@microsoft.com	63798129-a62c-4f9e-2c6d-08d772fcfb0e	spam attempt.	notJunk
ab2ad9b3-2213-4091-ae0c-08d76ddbcacf	2019-11-20T17:05:06.4088076Z	mail	block	malware	pending	administrator	avishaibrandies@microsoft.com	63798129-a62c-4f9e-2c6d-08d772fcfb0e	Malware attempt.	notJunk

msg-generate-login-url

Generate the login URL used for the authorization code flow.

Base Command

msg-generate-login-url

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Human Readable Output

Authorization instructions

1. Click on the login URL to sign in and grant Cortex XSOAR permissions for your Azure Service Management.
   You will be automatically redirected to a link with the following structure:
   REDIRECT_URI?code=AUTH_CODE&session_state=SESSION_STATE
2. Copy the AUTH_CODE (without the code= prefix, and the session_state parameter)
   and paste it in your instance configuration under the Authorization code parameter.

msg-advanced-hunting

Advanced hunting is a threat-hunting tool that uses specially constructed queries to examine the past 30 days of event data in Microsoft Graph Security.
To save result in context to ‘Microsoft365Defender’ as well, you can check the ‘Microsoft 365 Defender context’ checkbox in Instance Setting.

Base Command

msg-advanced-hunting

Input

Context Output

Command example

!msg-advanced-hunting query=AlertInfo limit=1

Context Example

{
    "Microsoft365Defender": {
        "Hunt": {
            "query": "AlertInfo | limit 1 ",
            "results": [
                {
                    "AlertId": "abc123",
                    "AttackTechniques": "",
                    "Category": "Exfiltration",
                    "DetectionSource": "Microsoft Data Loss Prevention",
                    "ServiceSource": "Microsoft Data Loss Prevention",
                    "Severity": "Medium",
                    "Timestamp": "2024-03-19T03:00:08Z",
                    "Title": "DLP policy (Custom policy) matched for email with subject (Splunk Report: High Or Critical Priority Host With Malware - 15 min)"
                }
            ]
        }
    },
    "MsGraph": {
        "Hunt": {
            "query": "AlertInfo | limit 1 ",
            "results": [
                {
                    "AlertId": "abc123",
                    "AttackTechniques": "",
                    "Category": "Exfiltration",
                    "DetectionSource": "Microsoft Data Loss Prevention",
                    "ServiceSource": "Microsoft Data Loss Prevention",
                    "Severity": "Medium",
                    "Timestamp": "2024-03-19T03:00:08Z",
                    "Title": "DLP policy (Custom policy) matched for email with subject (Splunk Report: High Or Critical Priority Host With Malware - 15 min)"
                }
            ]
        }
    }
}

Human Readable Output

See Results Above

msg-list-security-incident

Get a list of incident objects that Microsoft 365 Defender created to track attacks in an organization. If you want a specific incident, enter an incident ID.

Base Command

msg-list-security-incident

Input

Context Output

Command example

!msg-list-security-incident limit=1

Context Example

{
    "MsGraph": {
        "Incident": {
            "@odata.count": 26176,
            "value": [
                {
                    "Assigned to": null,
                    "Classification": "unknown",
                    "Created date time": "2024-03-19T08:08:33.2533333Z",
                    "Custom tags": "",
                    "Determination": "unknown",
                    "Display name": "DLP policy (Custom policy) matched for email with subject (Splunk Report: High Or Critical Priority Host With Malware - 15 min) involving one user",
                    "Severity": "medium",
                    "Status": "active",
                    "System tags": "",
                    "Updated date time": "2024-03-19T08:08:33.36Z",
                    "id": "12345"
                }
            ]
        }
    }
}

Human Readable Output

Incidents

Display name	id	Severity	Status	Assigned to	Custom tags	System tags	Classification	Determination	Created date time	Updated date time
DLP policy (Custom policy) matched for email with subject (Splunk Report: High Or Critical Priority Host With Malware - 15 min) involving one user	12345	medium	active				unknown	unknown	2024-03-19T08:08:33.2533333Z	2024-03-19T08:08:33.36Z

msg-update-security-incident

Update the incident with the given ID.

Base Command

msg-update-security-incident

Input

Context Output

Command example

!msg-update-security-incident incident_id=12345

Context Example

{
    "MsGraph": {
        "Incidents": {
            "assignedTo": "test5",
            "classification": "unknown",
            "comments": [],
            "createdDateTime": "2024-03-17T15:50:31.9033333Z",
            "customTags": [],
            "description": null,
            "determination": "unknown",
            "displayName": "Exfiltration incident involving one user",
            "id": "12345",
            "incidentWebUrl": "https://security.microsoft.com/incidents/12345?tid=abc123",
            "lastModifiedBy": "Microsoft 365 Defender-AlertCorrelation",
            "lastUpdateDateTime": "2024-03-19T07:24:34.7066667Z",
            "redirectIncidentId": null,
            "severity": "medium",
            "status": "active",
            "systemTags": [],
            "tenantId": "abc123"
        }
    }
}

Human Readable Output

Updated incident No. 12345

Display name	id	Severity	Status	Assigned to	Custom tags	System tags	Classification	Determination	Created date time	Updated date time
Exfiltration incident involving one user	12345	medium	active	test5			unknown	unknown	2024-03-17T15:50:31.9033333Z	2024-03-19T07:24:34.7066667Z

msg-run-estimate-statistics

Starts an eDiscovery estimate statistics operation in Microsoft Purview. The operation calculates the size and number of items matching the search query.

Base Command

msg-run-estimate-statistics

Input

Context Output

There is no context output for this command.

msg-get-last-estimate-statistics-operation

Retrieves the most recent eDiscovery estimate statistics operation for a given search in Microsoft Purview. Use this command after running ‘msg-run-estimate-statistics’ to check the results.

Base Command

msg-get-last-estimate-statistics-operation

Input

Context Output

msg-list-ediscovery-case-hold-policy

Get a list of the ediscoveryHoldPolicy objects and their properties.

Base Command

msg-list-ediscovery-case-hold-policy

Input

Context Output

msg-export-result-ediscovery-data

Export results from an estimated ediscoverySearch. For details, see Manage a collection estimate (https://learn.microsoft.com/en-us/purview/ediscovery-create-draft-collection#manage-a-collection-estimate).

Base Command

msg-export-result-ediscovery-data

Input

Context Output

Command example

!msg-export-result-ediscovery-data case_id=00000000-0000-0000-0000-000000000000 search_id=11111111-1111-1111-1111-111111111111 additional_options=none export_criteria=searchHits export_format=pst display_name="Example Export"

Context Example

{
    "MsGraph": {
        "eDiscoveryCase": {
            "Export": {
                "CaseID": "00000000-0000-0000-0000-000000000000",
                "Location": "https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/00000000-0000-0000-0000-000000000000/operations/example-operation-id",
                "OperationID": "example-operation-id"
            }
        }
    }
}

Human Readable Output

eDiscovery export request was submitted successfully.

• Case ID: 00000000-0000-0000-0000-000000000000
• Operation ID: example-operation-id

msg-delete-ediscovery-case-hold-policy

Delete an eDiscovery hold policy. This command submits a deletion request to Microsoft Graph; the policy may not be removed immediately and can take some time to complete.

Base Command

msg-delete-ediscovery-case-hold-policy

Input

Context Output

There is no context output for this command.

msg-list-case-operation

Get a list of the caseOperation objects and their properties, or retrieve a specific operation by ID. When operation_id is provided, you can set download_file=true to download the export report (if available).

Base Command

msg-list-case-operation

Input

Context Output

msg-create-ediscovery-case-hold-policy

Create a new ediscoveryHoldPolicy object.

Base Command

msg-create-ediscovery-case-hold-policy

Input

Context Output

msg-update-ediscovery-case-hold-policy

Update the properties of an ediscoveryHoldPolicy object.

Base Command

msg-update-ediscovery-case-hold-policy

Input

Context Output

There is no context output for this command.

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

• Fetch incidents

</~PLATFORM>