SecurityAndCompliance Deprecated

This integration allows you to manage and interact with Microsoft security and compliance content search.

Details

ID	`SecurityAndCompliance`
Provider	Microsoft
Category	Email
From Version	5.5.0
Docker Image	`demisto/powershell-ubuntu:7.3.0.49844`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

This integration enables you to manage and interact with Microsoft security and compliance content search. You can manage the security of all your organization’s emails, SharePoint sites, OneDrives, etc., by searching for text strings or queries based on attributes of a malicious email. However, you can only perform actions (preview and delete) on emails.
This integration was integrated and tested with Security & Compliance Center.

Important Note: Microsoft Office 365 no longer supports Basic Authentication. This version of the Security and Compliance integration will not function correctly beginning January 1st, 2023. Please use O365 Security and Compliance v2 instead.

Use Cases

Create / Modify / Get / List / Remove / Trigger a search in the Security & Compliance Center - Content search service.
Create / Get / List / Remove search actions in the Security & Compliance Center - Content search service. Supported actions for emails only are Purge (Delete) and Preview.

Playbooks

O365 - Security And Compliance - Search And Delete: Creates and starts a compliance search in the Security and Compliance Center to identify emails with similar attributes of a malicious email. If configured, will preview or delete the emails that were located. This playbook uses the following playbooks as sub-playbooks in its workflow.
O365 - Security And Compliance - Search: Creates and starts a compliance search in the Security and Compliance Center to identify emails with attributes similar to a malicious email.
O365 - Security And Compliance - Search Action - Delete: Deletes emails located by the O365 SecurityAndCompliance Search sub-playbook.
O365 - Security And Compliance - Search Action - Preview: Provides a preview of the results of emails located by the O365 SecurityAndCompliance Search sub-playbook.

Permissions in the Security & Compliance Center

To access the Security & Compliance Center, the user account needs to be a global administrator or needs to be assigned the Role Management role (a role is assigned only to the Organization Management role group). The Role Management role allows users to view, create, and modify role groups.

Login into the Security & Compliance Center:
From the side menu, click Permissions.
Search for and select the Data Investigator role.
Click Edit role group.
Click Choose Members and click Edit. Add the user you intend to be used in the integration:
Click Add.
Choose which members to add from the displayed list and click Add.
Click Done.

Enabling Client Side Basic Authentication

Client side basic authentication is necessary for O365 - Security And Compliance and is necessary for Powershell remoting.

Per Microsoft’s documentation, Security & Compliance PowerShell still requires Basic authentication in WinRM as described Prerequisites for the Exchange Online PowerShell module. REST API cmdlets that allow you to turn off Basic authentication in WinRM are not yet available for the Connect-IPPSSession cmdlet. For more information, see Updates for the EXO V3 module).

It is important to note that there are two types of basic authentication. The one that was deprecated which is the server side, and the other version which is the client side basic auth.
What the exchange library does when client side basic auth is enabled is to instead of sending “user:pass” in the headers, it sends “Bearer xyz”. The Exchange client itself, does not know the difference between the headers so when client basic auth is disabled, the bearer token can’t be sent.

Please note: The use of Username and Password is not indicative of the use of basic authentication. The PowerShell session uses modern authentication as noted here.

Create a Group in Active Directory called “Enable Client Basic Auth” and add the user you will use for the integration to the group.
Create a Policy in the Microsoft Endpoint Manager for - This can be found here
Search for “Basic” and you will see the Remote Management dropdown. Under this option, please enable “Client basic authentication”
Add the “Enable Client Basic Auth” group to the policy
In the Instance Configuration, click the Test button. This will likely return an error with a correlation ID.
Copy this ID and search for the correlation in the Risky Sign-Ins portal found here.
Since we generated this alert, we can confirm that the sign-in is safe. by clicking the option found below.
Finally return to the Instance Configuration and click the Test button to confirm the integration works.

Please Note: Microsoft requires that this connection be made from a secure connection. Disabling certificate verification is not supported at this time.

Additional Configuration/Debugging Options

In the event that the above does not result in a successful connection to Security and Compliance, we recommend the following:

Adding the IP address of the XSOAR server to the list of Named Locations.
Configuring the IP address of the XSOAR server as an exemption for multi-factor authentication. https://account.activedirectory.windowsazure.com/usermanagement/mfasettings.aspx?tenantid={YOUR-TENANT-ID}
Dismissing the user’s risk level and state in the Risky Users Portal

Configure SecurityAndCompliance on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for O365 - Security And Compliance - Content Search.

Authentication / Authorization methods:

OAuth2.0 authorization (recommended):

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
url	Search and Compliance URL	True
credentials	Fill only Email (aka UPN), Password should be empty.	False
insecure	Trust any certificate (not secure)	False

Open playground - War-room:
1. Run the !o365-sc-auth-start command and follow the instructions. Expected output is:
Security And Compliance - Authorize instructions
1. To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXX to authenticate.
2. Run the command !o365-sc-auth-complete command in the War Room.
1. Test - OAuth2.0 authorization, Run the !o365-sc-auth-test command.

Basic authentication (Not recommended):

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
url	Search and Compliance URL	True
credentials	Fill Email (aka UPN) and password	False
insecure	Trust any certificate (not secure)	False

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

o365-sc-auth-start

OAuth2.0 - Start authorization.

Base Command

o365-sc-auth-start

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

>## Security And Compliance - Authorize instructions
>
>1. To sign in, use a web browser to open the page [https://microsoft.com/devicelogin](https://microsoft.com/devicelogin) and enter the code **XXXXXXX** to authenticate.
>2. Run the ***!o365-sc-auth-complete*** command in the War Room.

### o365-sc-auth-complete

***
OAuth2.0 - Complete authorization.

#### Base Command

`o365-sc-auth-complete`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!o365-sc-auth-complete```

#### Human Readable Output

>Your account **successfully** authorized!

### o365-sc-auth-test

***
OAuth2.0 - Test authorization.

#### Base Command

`o365-sc-auth-test`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!o365-sc-auth-test```

#### Human Readable Output

>**Test ok!**

### o365-sc-new-search

***
Create compliance search in the Security & Compliance Center.

#### Base Command

`o365-sc-new-search`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| search_name | The name of the compliance search. If not specified, will have the prefix "XSOAR-" followed by the GUID e.g., XSOAR-d6228fd0-756b-4e4b-8721-76776df91526. | Required |
| case | The name of a Core eDiscovery case to associate with the new compliance search. | Optional |
| kql | Text search string or a query that is formatted using the Keyword Query Language (KQL). [Tips for finding messages to remove using KQL](#tips-for-finding-messages-to-remove)
| Optional |
| description | Description of the compliance search. | Optional |
| allow_not_found_exchange_locations | Whether to include mailboxes other than regular user mailboxes in the compliance search. Default is "false". | Optional |
| exchange_location | Comma-separated list of mailboxes/distribution groups to include, or you can use the value "All" to include all. | Optional |
| exchange_location_exclusion | Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter. | Optional |
| public_folder_location | Comma-separated list of public folders to include, or you can use the value "All" to include all. | Optional |
| share_point_location | Comma-separated list of SharePoint online sites to include. You can identify the sites by their URL value, or you can use the value "All" to include all sites. | Optional |
| share_point_location_exclusion | Comma-separated list of SharePoint online sites to exclude when you use the value "All" for the share_point_location argument. You can identify the sites by their URL value. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled | Boolean | Whether to include mailboxes other than regular user mailboxes in the compliance search. |
| O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled | Boolean | Whether the Azure Batch Framework is enabled for job processing. |
| O365.SecurityAndCompliance.ContentSearch.Search.CaseId | String | Identity of a Core eDiscovery case which is associated with the compliance search. |
| O365.SecurityAndCompliance.ContentSearch.Search.CaseName | String | Name of a Core eDiscovery case which is associated with the compliance search. |
| O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery | String | Compliance text search string or a query that is formatted using the Keyword Query Language \(KQL\). |
| O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy | String | Security and compliance search creator. |
| O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime | Date | Security and compliance search creation time. |
| O365.SecurityAndCompliance.ContentSearch.Search.Description | String | Security and compliance search description. |
| O365.SecurityAndCompliance.ContentSearch.Search.Errors | String | Security and compliance search errors. |
| O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation | String | Security and compliance search exchange locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.Identity | String | Security and compliance search identity. |
| O365.SecurityAndCompliance.ContentSearch.Search.IsValid | Boolean | Whether the security and compliance search is valid. |
| O365.SecurityAndCompliance.ContentSearch.Search.Items | Number | The number of security and compliance search scanned items. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime | Date | Security and compliance search job end time. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobId | String | Security and compliance search job ID. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobRunId | String | Security and compliance search job run ID. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime | Date | Security and compliance search job run start time. |
| O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime | Date | Security and compliance search last modification time. |
| O365.SecurityAndCompliance.ContentSearch.Search.LogLevel | String | Security and compliance search Azure log level. |
| O365.SecurityAndCompliance.ContentSearch.Search.Name | String | Security and compliance search name. |
| O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation | String | Security and compliance search OneDrive locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion | String | Security and compliance search OneDrive locations to exclude. |
| O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation | String | Security and compliance search public folder locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion | String | Security and compliance search public folder locations to exclude. |
| O365.SecurityAndCompliance.ContentSearch.Search.RunBy | String | Security and compliance search last run by UPN \(Email representation\). |
| O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId | String | Security and compliance search run space ID. |
| O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation | String | Security and compliance search SharePoint locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.Size | Number | Security and compliance search bytes results size. |
| O365.SecurityAndCompliance.ContentSearch.Search.Status | String | Security and compliance search status. |
| O365.SecurityAndCompliance.ContentSearch.Search.TenantId | String | Security and compliance search Tenant ID. |

#### Command Example

```!o365-sc-new-search search_name="example" exchange_location="user1@demistodev.onmicrosoft.com,user2@demistodev.onmicrosoft.com" allow_not_found_exchange_locations=true kql="Rodrigo"```

#### Context Example

```json
{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "Search": {
                    "AllowNotFoundExchangeLocationsEnabled": true,
                    "AzureBatchFrameworkEnabled": false,
                    "CaseId": null,
                    "CaseName": "",
                    "ContentMatchQuery": "Rodrigo",
                    "CreatedBy": "XSOAR-user",
                    "CreatedTime": "2020-11-29T07:12:46.5943533Z",
                    "Description": "Short description",
                    "Errors": null,
                    "ExchangeLocation": [
                        "test1@onmicrosoft.com",
                        "test2@onmicrosoft.com"
                    ],
                    "ExchangeLocationExclusion": [],
                    "Identity": "xxxxx",
                    "IsValid": true,
                    "Items": 0,
                    "JobEndTime": null,
                    "JobId": "xxxxx",
                    "JobRunId": null,
                    "JobStartTime": null,
                    "LastModifiedTime": "2020-11-29T07:12:46.5943533Z",
                    "LogLevel": "Suppressed",
                    "Name": "example",
                    "OneDriveLocation": null,
                    "OneDriveLocationExclusion": null,
                    "PublicFolderLocation": null,
                    "PublicFolderLocationExclusion": null,
                    "RunBy": "",
                    "RunspaceId": null,
                    "SharePointLocation": null,
                    "SharePointLocationExclusion": null,
                    "Size": 0,
                    "Status": "NotStarted",
                    "SuccessResults": null,
                    "TenantId": "xxxxx"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - New search ‘example’ created

ContentMatchQuery CreatedBy Description LastModifiedTime Name

Rodrigo XSOAR-user Short description 11/29/2020 7:12:46 AM example

ContentMatchQuery	CreatedBy	Description	LastModifiedTime	Name
Rodrigo	XSOAR-user	Short description	11/29/2020 7:12:46 AM	example

o365-sc-set-search

Modifies non-running compliance searches in the Security & Compliance Center.

Base Command

o365-sc-set-search

Input

Argument Name	Description	Required
search_name	The name of the compliance search.	Required
kql	Modify the text search string or a query that is formatted using the Keyword Query Language (KQL).	Optional
description	Modify the description for the compliance search.	Optional
allow_not_found_exchange_locations	Whether to include mailboxes other than regular user mailboxes in the compliance search.	Optional
add_exchange_location	Comma-separated list of added mailboxes/distribution groups to include, or you can use the value “All” to include all mailboxes.	Optional
add_exchange_location_exclusion	Comma-separated list of added mailboxes/distribution groups to exclude when you use the value “All” for the exchange_location (used in create new compliance search) or the add_exchange_location argument.	Optional
add_public_folder_location	Comma-separated list of added public folders to include, or you can use the value “All” to include all.	Optional
add_share_point_location	Comma-separated list of added SharePoint online sites to include. You identify the sites by their URL value, or you can use the value “All” to include all sites.	Optional
add_share_point_location_exclusion	Comma-separated list of added SharePoint online sites to exclude when you use the value “All” for the exchange_location (used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value.	Optional
remove_exchange_location	Comma-separated list of removed mailboxes/distribution group to include.	Optional
remove_exchange_location_exclusion	Comma-separated list of removed mailboxes/distribution group to exclude when you use the value “All” for the exchange_location (Used in create new compliance search) or the add_exchange_location argument.	Optional
remove_public_folder_location	Comma-separated list of removed public folders to include.	Optional
remove_share_point_location	Comma-separated list of removed SharePoint online sites to include. You can identify the sites by their URL value.	Optional
remove_share_point_location_exclusion	Comma-separated list of removed SharePoint online sites to exclude when you use the value “All” for the exchange_location (Used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value.	Optional

Context Output

There is no context output for this command.

Command Example

!o365-sc-set-search search_name="example" remove_exchange_location="test2@demistodev.onmicrosoft.com"

Human Readable Output

Security And Compliance - Search example modified!

o365-sc-remove-search

Remove compliance search by name from the Security & Compliance Center.

Base Command

o365-sc-remove-search

Input

Argument Name	Description	Required
search_name	The name of the compliance search.	Required

Context Output

There is no context output for this command.

Command Example

!o365-sc-remove-search search_name="example"

Human Readable Output

Security And Compliance - Search example removed!

o365-sc-list-search

List compliance searches in the Security & Compliance Center.

Base Command

o365-sc-list-search

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled	Boolean	Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled	Boolean	Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.Search.CaseId	String	Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.CaseName	String	Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery	String	Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy	String	Security and compliance search creator.
O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime	Date	Security and compliance search creation time.
O365.SecurityAndCompliance.ContentSearch.Search.Description	String	Security and compliance search description.
O365.SecurityAndCompliance.ContentSearch.Search.Errors	String	Security and compliance search errors.
O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation	String	Security and compliance search exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Identity	String	Security and compliance search identity.
O365.SecurityAndCompliance.ContentSearch.Search.IsValid	Boolean	Whether the security and compliance search is valid.
O365.SecurityAndCompliance.ContentSearch.Search.Items	Number	The number of security and compliance search scanned items.
O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime	Date	Security and compliance search job end time.
O365.SecurityAndCompliance.ContentSearch.Search.JobId	String	Security and compliance search job ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobRunId	String	Security and compliance search job run ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime	Date	Security and compliance search job run start time.
O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime	Date	Security and compliance search last modification time.
O365.SecurityAndCompliance.ContentSearch.Search.LogLevel	String	Security and compliance search Azure log level.
O365.SecurityAndCompliance.ContentSearch.Search.Name	String	Security and compliance search name.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation	String	Security and compliance search OneDrive locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion	String	Security and compliance search OneDrive locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation	String	Security and compliance search public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion	String	Security and compliance search public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.RunBy	String	Security and compliance search last run by UPN (Email representation).
O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId	String	Security and compliance search run space ID.
O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation	String	Security and compliance search SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Size	Number	Security and compliance search bytes results size.
O365.SecurityAndCompliance.ContentSearch.Search.Status	String	Security and compliance search status.
O365.SecurityAndCompliance.ContentSearch.Search.TenantId	String	Security and compliance search Tenant ID.

Command Example


#### Context Example

```json
{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "Search": [
                    {
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "ContentMatchQuery": "subject:test",
                        "CreatedBy": "XSOAR-user1",
                        "CreatedTime": "2019-08-22T06:43:48.747",
                        "Description": "Short description",
                        "Errors": null,
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "Items": 0,
                        "JobEndTime": "2019-09-05T13:21:11.563",
                        "JobId": "xxxx",
                        "JobRunId": null,
                        "JobStartTime": "2019-09-05T13:20:34.633",
                        "LastModifiedTime": "2019-08-22T06:43:48.747",
                        "LogLevel": "Suppressed",
                        "Name": "example1",
                        "OneDriveLocation": null,
                        "OneDriveLocationExclusion": null,
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "RunBy": "XSOAR-user1",
                        "RunspaceId": null,
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Size": 0,
                        "Status": "Completed",
                        "SuccessResults": null,
                        "TenantId": "xxxx"
                    },
                    {
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "ContentMatchQuery": "subject:Incident Summary Report",
                        "CreatedBy": "XSOAR-user2",
                        "CreatedTime": "2020-01-08T00:44:30.94",
                        "Description": "Short description",
                        "Errors": null,
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "Items": 0,
                        "JobEndTime": "2020-01-08T00:45:13.433",
                        "JobId": "xxxxx",
                        "JobRunId": null,
                        "JobStartTime": "2020-01-08T00:44:33.717",
                        "LastModifiedTime": "2020-01-08T00:44:30.94",
                        "LogLevel": "Suppressed",
                        "Name": "example2",
                        "OneDriveLocation": null,
                        "OneDriveLocationExclusion": null,
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "RunBy": "XSOAR-user2",
                        "RunspaceId": null,
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Size": 0,
                        "Status": "Completed",
                        "SuccessResults": null,
                        "TenantId": "xxxxx"
                    }
                ]
            }
        }
    }
}

Human Readable Output

Security And Compliance - Search configurations

CreatedBy Description LastModifiedTime Name RunBy

XSOAR-user1 Short description 8/22/2019 6:43:48 AM example1 XSOAR-user1

XSOAR-user2 Short description 1/8/2020 12:44:30 AM example2 XSOAR-user2

CreatedBy	Description	LastModifiedTime	Name	RunBy
XSOAR-user1	Short description	8/22/2019 6:43:48 AM	example1	XSOAR-user1
XSOAR-user2	Short description	1/8/2020 12:44:30 AM	example2	XSOAR-user2

o365-sc-get-search

Gets compliance search by name from the Security & Compliance Center.

Base Command

o365-sc-get-search

Input

Argument Name	Description	Required
search_name	The name of the compliance search.	Required
limit	The maximum number of results to return. If you want to return all requests that match the query, use “-1” for the value of this argument.	Optional
all_results	Whether to include mailboxes which have no results in results entry context.	Optional
export	Whether to export search results as json file to war-room.	Optional
statistics	Show search statistics. Default is “false”.	Optional

Context Output

Path	Type	Description
O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled	Boolean	Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled	Boolean	Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.Search.CaseId	String	Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.CaseName	String	Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery	String	Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy	String	Security and compliance search creator.
O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime	Date	Security and compliance search creation time.
O365.SecurityAndCompliance.ContentSearch.Search.Description	String	Security and compliance search description.
O365.SecurityAndCompliance.ContentSearch.Search.Errors	String	Security and compliance search errors.
O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation	String	Security and compliance search exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Identity	String	Security and compliance search identity.
O365.SecurityAndCompliance.ContentSearch.Search.IsValid	Boolean	Whether the security and compliance search is valid.
O365.SecurityAndCompliance.ContentSearch.Search.Items	Number	Number of security and compliance search scanned items.
O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime	Date	Security and compliance search job end time.
O365.SecurityAndCompliance.ContentSearch.Search.JobId	String	Security and compliance search job ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobRunId	String	Security and compliance search job run ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime	Date	Security and compliance search job run start time.
O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime	Date	Security and compliance search last modification time.
O365.SecurityAndCompliance.ContentSearch.Search.LogLevel	String	Security and compliance search the Azure log level.
O365.SecurityAndCompliance.ContentSearch.Search.Name	String	Security and compliance search name.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation	String	Security and compliance search OneDrive locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion	String	Security and compliance search OneDrive locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation	String	Security and compliance search public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion	String	Security and compliance search public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.RunBy	String	Security and compliance search last run by UPN (Email representation).
O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId	String	Security and compliance search run space ID.
O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation	String	Security and compliance search SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Size	Number	Security and compliance search bytes results size.
O365.SecurityAndCompliance.ContentSearch.Search.Status	String	Security and compliance search status.
O365.SecurityAndCompliance.ContentSearch.Search.TenantId	String	Security and compliance search Tenant ID.
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Location	String	Security and compliance search result location.
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.ItemsCount	Number	The number of security and compliance search results in location.
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Size	Number	The byte size of the security and compliance search results in location.

Command Example

!o365-sc-get-search search_name="example"

Context Example

{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "Search": {
                    "Errors": "", 
                    "AzureBatchFrameworkEnabled": false,
                    "TenantId": "xxxxx", 
                    "SharePointLocationExclusion": null, 
                    "JobStartTime": "2020-11-29T07:20:59.37", 
                    "CreatedTime": "2020-11-29T07:18:04.283", 
                    "OneDriveLocation": null, 
                    "PublicFolderLocation": null, 
                    "Status": "Completed", 
                    "CaseName": "", 
                    "AllowNotFoundExchangeLocationsEnabled": false, 
                    "LogLevel": "Suppressed", 
                    "JobRunId": null, 
                    "CaseId": null, 
                    "JobId": "xxxxx", 
                    "SuccessResults": {
                        "ItemsCount": "122303", 
                        "Location": "user@onmicrosoft.com", 
                        "Size": "12339007379"
                    }, 
                    "LastModifiedTime": "2020-11-29T07:20:43.283", 
                    "Identity": "1d130723-fe0a-4726-6d2a-08d89437520e", 
                    "Name": "example", 
                    "Items": 122303, 
                    "ExchangeLocation": [
                        "user@onmicrosoft.com"
                    ], 
                    "RunBy": "XSOAR-user", 
                    "Description": "Short description", 
                    "ExchangeLocationExclusion": [], 
                    "IsValid": true, 
                    "PublicFolderLocationExclusion": null, 
                    "SharePointLocation": null, 
                    "CreatedBy": "XSOAR-user", 
                    "JobEndTime": "2020-11-29T07:22:01.99", 
                    "RunspaceId": null, 
                    "Size": 12339007379, 
                    "OneDriveLocationExclusion": null, 
                    "ContentMatchQuery": "Rodrigo"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - ‘example’ search

CreatedBy Description LastModifiedTime Name RunBy Status

XSOAR-user Short description 2020-11-29T07:20:43.283 example XSOAR-user NotStarted

CreatedBy	Description	LastModifiedTime	Name	RunBy	Status
XSOAR-user	Short description	2020-11-29T07:20:43.283	example	XSOAR-user	NotStarted

o365-sc-start-search

Starts stopped, completed, or not started compliance search in the Security & Compliance Center.

Base Command

o365-sc-start-search

Input

Argument Name	Description	Required
search_name	The name of the compliance search.	Required

Context Output

There is no context output for this command.

Command Example

!o365-sc-start-search search_name="example"

Human Readable Output

Security And Compliance - search example started !

o365-sc-stop-search

Stop running compliance search in the Security & Compliance Center.

Base Command

o365-sc-stop-search

Input

Argument Name	Description	Required
search_name	The name of the compliance search.	Required

Context Output

There is no context output for this command.

Command Example

!o365-sc-stop-search search_name="example"

Human Readable Output

Security And Compliance - search example stopped !

o365-sc-new-search-action

After you create a content search using the o365-sc-new-search command and run it using the o365-sc-start-search command, you assign a search action to the search using the o365-sc-new-search-action command.

Base Command

o365-sc-new-search-action

Input

Argument Name	Description	Required
search_name	The name of the compliance search.	Required
action	Search action to perform. Possible values are: “Preview” and “Purge”. Default is “Preview”.	Optional
purge_type	Purge type. Possible values are: “Soft Delete” and “HardDelete”. Default is “SoftDelete”.	Optional

Context Output

Path	Type	Description
O365.SecurityAndCompliance.ContentSearch.SearchAction.Action	String	Security and compliance search action type. Either “Purge” or “Preview”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled	Boolean	Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled	Boolean	Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId	String	Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName	String	Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy	String	Security and compliance search action creator.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime	Date	Security and compliance search action creation time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Description	String	Security and compliance search action description.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors	String	Security and compliance search action errors.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId	String	Security and compliance search action job ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId	String	Security and compliance search action run ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation	String	Security and compliance search action exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion	String	Security and compliance search action exchange locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity	String	Security and compliance search action identity.
O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid	Boolean	Whether the security and compliance search action is valid.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime	Date	Security and compliance search action job end time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId	String	Security and compliance search action job ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId	String	Security and compliance search action job run ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime	Date	Security and compliance search action job start time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime	Date	Security and compliance search action last modified time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Name	String	Security and compliance search action name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation	String	Security and compliance search action public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion	String	Security and compliance search action public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry	Boolean	Whether to retry if the search action failed.
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy	String	Security and compliance search action run by UPN (email address).
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId	String	Security and compliance search action run space ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName	String	Security and compliance search action search name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation	String	Security and compliance search action SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion	String	Security and compliance search action SharePoint locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Status	String	Security and compliance search action status. Either “Started” or “Completed”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId	String	Security and compliance search action Tenant ID.

Command Example

!o365-sc-new-search-action search_name="example" action="Preview"

Context Example

{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "SearchAction": {
                    "Action": "Preview",
                    "AllowNotFoundExchangeLocationsEnabled": false,
                    "AzureBatchFrameworkEnabled": false,
                    "CaseId": null,
                    "CaseName": "",
                    "CreatedBy": "XSOAR-user",
                    "CreatedTime": "2020-11-29T07:23:50.05",
                    "Description": "",
                    "Errors": "",
                    "EstimateSearchJobId": "xxxxx",
                    "EstimateSearchRunId": "xxxxx",
                    "ExchangeLocation": [
                        "user@onmicrosoft.com"
                    ],
                    "ExchangeLocationExclusion": null,
                    "Identity": "xxxxx",
                    "IsValid": true,
                    "JobEndTime": "2020-11-29T07:24:05.76",
                    "JobId": "xxxxx",
                    "JobRunId": "xxxxx",
                    "JobStartTime": "2020-11-29T07:23:50.297",
                    "LastModifiedTime": "2020-11-29T07:23:50.05",
                    "Name": "example_Preview",
                    "PublicFolderLocation": null,
                    "PublicFolderLocationExclusion": null,
                    "Results": null,
                    "Retry": false,
                    "RunBy": "XSOAR-user",
                    "RunspaceId": "xxxxx",
                    "SearchName": "example",
                    "SharePointLocation": null,
                    "SharePointLocationExclusion": null,
                    "Status": "Completed",
                    "TenantId": "xxxxx"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - search action ‘example_Preview’ created

Action LastModifiedTime Name RunBy SearchName Status

Preview 11/29/2020 7:23:50 AM example_Preview XSOAR-user example Completed

Action	LastModifiedTime	Name	RunBy	SearchName	Status
Preview	11/29/2020 7:23:50 AM	example_Preview	XSOAR-user	example	Completed

o365-sc-remove-search-action

Removes compliance search action by search the action name from the Security & Compliance Center.

Base Command

o365-sc-remove-search-action

Input

Argument Name	Description	Required
search_action_name	The name of the compliance search action.	Required

Context Output

There is no context output for this command.

Command Example

!o365-sc-remove-search-action search_action_name="example_Preview"

Human Readable Output

Security And Compliance - search action example_Preview removed!

o365-sc-list-search-action

Lists compliance search actions from the Security & Compliance Center.

Base Command

o365-sc-list-search-action

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
O365.SecurityAndCompliance.ContentSearch.SearchAction.Action	String	Security and compliance search action type. Either “Purge or “Preview”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled	Boolean	Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled	Boolean	Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId	String	Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName	String	Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy	String	Security and compliance search action creator.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime	Date	Security and compliance search action creation time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Description	String	Security and compliance search action description.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors	String	Security and compliance search action errors.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId	String	Security and compliance search action job ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId	String	Security and compliance search action run ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation	String	Security and compliance search action exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion	String	Security and compliance search action exchange locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity	String	Security and compliance search action identity.
O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid	Boolean	Whether the security and compliance search action is valid.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime	Date	Security and compliance search action job end time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId	String	Security and compliance search action job ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId	String	Security and compliance search action job run ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime	Date	Security and compliance search action job start time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime	Date	Security and compliance search action last modified time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Name	String	Security and compliance search action name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation	String	Security and compliance search action public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion	String	Security and compliance search action public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry	Boolean	Whether to retry if the search action failed.
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy	String	Security and compliance search action run by UPN (email address).
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId	String	Security and compliance search action run space ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName	String	Security and compliance search action search name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation	String	Security and compliance search action SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion	String	Security and compliance search action SharePoint locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Status	String	Security and compliance search action status (Started/Completed).
O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId	String	Security and compliance search action Tenant ID.

Command Example


#### Context Example

```json
{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "SearchAction": [
                    {
                        "Action": "Preview",
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "CreatedBy": "XSOAR-user",
                        "CreatedTime": "2020-10-14T13:45:44.14",
                        "Description": "",
                        "Errors": "",
                        "EstimateSearchJobId": "xxxxx",
                        "EstimateSearchRunId": "xxxxx",
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "JobEndTime": "2020-10-14T13:47:00.103",
                        "JobId": "xxxxx",
                        "JobRunId": "xxxxx",
                        "JobStartTime": "2020-10-14T13:45:58.443",
                        "LastModifiedTime": "2020-10-14T13:45:44.14",
                        "Name": "example_Preview",
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "Results": null,
                        "Retry": false,
                        "RunBy": "XSOAR-user",
                        "RunspaceId": "xxxxx",
                        "SearchName": "example",
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Status": "Completed",
                        "TenantId": "xxxxx"
                    },
                   {
                        "Action": "Purge",
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "CreatedBy": "XSOAR-user1",
                        "CreatedTime": "2020-10-14T13:45:44.14",
                        "Description": "",
                        "Errors": "",
                        "EstimateSearchJobId": "xxxxx",
                        "EstimateSearchRunId": "xxxxx",
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "JobEndTime": "2020-10-14T13:47:00.103",
                        "JobId": "xxxxx",
                        "JobRunId": "xxxxx",
                        "JobStartTime": "2020-10-14T13:45:58.443",
                        "LastModifiedTime": "2020-10-14T13:45:44.14",
                        "Name": "example_Purge",
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "Results": null,
                        "Retry": false,
                        "RunBy": "XSOAR-user1",
                        "RunspaceId": "xxxxx",
                        "SearchName": "Rodrigo-diffrent",
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Status": "Completed",
                        "TenantId": "xxxxx"
                    }
                ]
            }
        }
    }
}

Human Readable Output

Security And Compliance - search actions

Action JobEndTime LastModifiedTime Name RunBy SearchName Status

Preview 10/14/2020 1:47:00 PM 10/14/2020 1:45:44 PM example_Preview XSOAR-user example Completed

Purge 11/25/2020 10:51:04 AM 11/25/2020 10:50:37 AM example_Purge XSOAR-user example Completed

Action	JobEndTime	LastModifiedTime	Name	RunBy	SearchName	Status
Preview	10/14/2020 1:47:00 PM	10/14/2020 1:45:44 PM	example_Preview	XSOAR-user	example	Completed
Purge	11/25/2020 10:51:04 AM	11/25/2020 10:50:37 AM	example_Purge	XSOAR-user	example	Completed

o365-sc-get-search-action

Gets compliance search action from the Security & Compliance Center.

Base Command

o365-sc-get-search-action

Input

Argument Name	Description	Required
search_action_name	The name of the compliance search action.	Required
limit	The maximum number of results to return. If you want to return all requests that match the query, use “-1” for the value of this argument.	Optional
export	Whether to export search results as json file to war-room.	Optional
results	Whether to print the results in the War Room. Default is “false”.	Optional

Context Output

Path	Type	Description
O365.SecurityAndCompliance.ContentSearch.SearchAction.Action	String	Security and compliance search action type. Either “Purge” or “Preview”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled	Boolean	Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled	Boolean	Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId	String	Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName	String	Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy	String	Security and compliance search action creator.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime	Date	Security and compliance search action creation time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Description	String	Security and compliance search action description.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors	String	Security and compliance search action errors.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId	String	Security and compliance search action job ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId	String	Security and compliance search action run ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation	String	Security and compliance search action exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion	String	Security and compliance search action exchange locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity	String	Security and compliance search action identity.
O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid	Boolean	Whether the security and compliance search action is valid.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime	Date	Security and compliance search action job end time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId	String	Security and compliance search action job ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId	String	Security and compliance search action job run ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime	Date	Security and compliance search action job start time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime	Date	Security and compliance search action last modified time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Name	String	Security and compliance search action name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation	String	Security and compliance search action public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion	String	Security and compliance search action public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Location	String	Security and compliance search action result location.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ItemCount	String	Security and compliance search action result item count.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.TotalSize	String	Security and compliance search action result total size.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.FailedCount	String	Security and compliance search action result failed count.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Sender	String	Security and compliance search action result mail sender.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Subject	String	Security and compliance search action result subject.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Type	String	Security and compliance search action result type.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Size	String	Security and compliance search action result size.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ReceivedTime	Date	Security and compliance search action result received time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.DataLink	String	Security and compliance search action data link.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry	Boolean	Whether to retry if the search action failed.
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy	String	Security and compliance search action run by UPN (email address).
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId	String	Security and compliance search action run space ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName	String	Security and compliance search action search name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation	String	Security and compliance search action SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion	String	Security and compliance search action SharePoint locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Status	String	Security and compliance search action status. Either “Started” or “Completed”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId	String	Security and compliance search action Tenant ID.

Command Example

!o365-sc-get-search-action search_action_name="example_Preview"

Context Example

{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "SearchAction": {
                    "Action": "Preview",
                    "AllowNotFoundExchangeLocationsEnabled": false,
                    "AzureBatchFrameworkEnabled": false,
                    "CaseId": null,
                    "CaseName": "",
                    "CreatedBy": "XSOAR-user",
                    "CreatedTime": "2020-11-29T07:23:50.05",
                    "Description": "",
                    "Errors": "",
                    "EstimateSearchJobId": "2a967c40-07c3-4903-ed7f-08d89436e9b1",
                    "EstimateSearchRunId": "1d130723-fe0a-4726-6d2a-08d89437520e",
                    "ExchangeLocation": [
                        "user@onmicrosoft.com"
                    ],
                    "ExchangeLocationExclusion": null,
                    "Identity": "xxxxx",
                    "IsValid": true,
                    "JobEndTime": "2020-11-29T07:24:05.76",
                    "JobId": "xxxxx",
                    "JobRunId": "xxxxx",
                    "JobStartTime": "2020-11-29T07:23:50.297",
                    "LastModifiedTime": "2020-11-29T07:23:50.05",
                    "Name": "example_Preview",
                    "PublicFolderLocation": null,
                    "PublicFolderLocationExclusion": null,
                    "Results": [
                        {
                            "DataLink": "data/All/xxxx.eml",
                            "Location": "user@onmicrosoft.com",
                            "ReceivedTime": "11/26/2020 2:59:01 PM",
                            "Sender": "Some user",
                            "Size": "19683",
                            "Subject": "Test1",
                            "Type": "Email"
                        },
                       {
                            "DataLink": "data/All/xxxx.eml",
                            "Location": "user@onmicrosoft.com",
                            "ReceivedTime": "12/26/2020 2:59:01 PM",
                            "Sender": "Some user",
                            "Size": "20225",
                            "Subject": "Test2",
                            "Type": "Email"
                        },
                    ],
                    "Retry": false,
                    "RunBy": "XSOAR-user",
                    "RunspaceId": "xxxxx",
                    "SearchName": "example",
                    "SharePointLocation": null,
                    "SharePointLocationExclusion": null,
                    "Status": "Completed",
                    "TenantId": "xxxxx"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - search action ‘example_Preview’

Action JobEndTime LastModifiedTime Name RunBy SearchName Status

Preview 11/29/2020 7:24:05 AM 11/29/2020 7:23:50 AM example_Preview XSOAR-user example Completed

Action	JobEndTime	LastModifiedTime	Name	RunBy	SearchName	Status
Preview	11/29/2020 7:24:05 AM	11/29/2020 7:23:50 AM	example_Preview	XSOAR-user	example	Completed

Tips for finding messages to remove

Keyword Query Language (KQL)
- If you know the exact text or phrase used in the subject line of the message, use the Subject property in the search query, e.g., (subject:give me all ur money).
- If you know that exact date (or date range) of the message, include the Received property in the search query, e.g., (received:6/13/2021..6/16/2021).
- If you know who sent the message, include the From property in the search query, e.g., (from:user1@demistodev.onmicrosoft.com).
- For all the available search properties see: Keyword queries and search conditions for eDiscovery.
Preview the search results to verify that the search returned only the message (or messages) that you want to delete.
Use the search estimate statistics (displayed by using the o365-sc-get-search command) to get a count of the total number of emails.

Known Limitations

Security and compliance integrations do not support Security and compliance on-premise.
Each security and compliance command creates a PSSession (PowerShell session). The security and compliance PowerShell limits the number of concurrent sessions to 3. Since this affects the behavior of multiple playbooks running concurrently it we recommend that you retry failed tasks when using the integration commands in playbooks.
Proxies are not supported due to a Microsoft limitation.
Due to a Microsoft limitation, you can perform a search and purge operation on a maximum of 50,000 mailboxes. To work around this limitation, configure multiple instances of the integration each with different permission filtering so that the number of mailboxes in each instance does not exceed 50,000.
A maximum of 10 items per mailbox can be removed at one time, due to a Microsoft limitiation.
For more Microsoft known limitations see Limits for eDiscovery search.

Configuration parameters

url — Search and Compliance URL (required)
credentials — Email / User Principal Name (Required)
insecure — Trust any certificate (not secure)

Commands (14)

o365-sc-auth-complete
OAuth2.0 - Complete authorization.
o365-sc-auth-start
OAuth2.0 - Start authorization.
o365-sc-auth-test
OAuth2.0 - Test authorization.
o365-sc-get-search
Gets compliance search by name from the Security & Compliance Center.
o365-sc-get-search-action
Gets compliance search action from the Security & Compliance Center.
o365-sc-list-search
List compliance searches in the Security & Compliance Center.
o365-sc-list-search-action
Lists compliance search actions from the Security & Compliance Center.
o365-sc-new-search
Create compliance search in the Security & Compliance Center.
o365-sc-new-search-action
After you create a content search using the o365-sc-new-search command and run it using the o365-sc-start-search command, you assign a search action to the search using the o365-sc-new-search-action command.
o365-sc-remove-search
Remove compliance search by name from the Security & Compliance Center.
o365-sc-remove-search-action
Removes a compliance search action by searching for the action name in the Security & Compliance Center.
o365-sc-set-search
Modifies non-running compliance searches in the Security & Compliance Center.
o365-sc-start-search
Starts stopped, completed, or not started compliance search in the Security & Compliance Center.
o365-sc-stop-search
Stop running compliance search in the Security & Compliance Center.

Source

SecurityAndCompliance.Tests.ps1 SecurityAndCompliance.ps1 SecurityAndCompliance.yml SecurityAndCompliance_description.md

Download History Raw

category: Email
provider: Microsoft
commonfields:
  id: SecurityAndCompliance
  version: -1
configuration:
- defaultvalue: https://ps.compliance.protection.outlook.com
  display: Search and Compliance URL
  name: url
  required: true
  type: 0
- display: Email / User Principal Name (Required)
  displaypassword: Password (Required for Basic authentication only)
  name: credentials
  defaultvalue: ""
  type: 9
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
description: This integration allows you to manage and interact with Microsoft security and compliance content search.
display: O365 - Security And Compliance - Content Search (Deprecated)
deprecated: true
name: SecurityAndCompliance
script:
  commands:
  - description: OAuth2.0 - Start authorization.
    name: o365-sc-auth-start
  - description: OAuth2.0 - Complete authorization.
    name: o365-sc-auth-complete
  - description: OAuth2.0 - Test authorization.
    name: o365-sc-auth-test
  - arguments:
    - description: |
        The name of the compliance search.
        If not specified, will have the prefix "XSOAR-" followed by the GUID e.g., XSOAR-d6228fd0-756b-4e4b-8721-76776df91526.
      name: search_name
    - description: The name of a Core eDiscovery case to associate with the new compliance search.
      name: case
    - description: Text search string or a query that is formatted using the Keyword Query Language (KQL).
      name: kql
    - description: Description of the compliance search.
      name: description
    - description: Whether to include mailboxes other than regular user mailboxes in the compliance search. Default is "false".
      name: allow_not_found_exchange_locations
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - description: Comma-separated list of mailboxes/distribution groups to include, or you can use the value "All" to include all.
      isArray: true
      name: exchange_location
      defaultValue: 'All'
    - description: Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter.
      isArray: true
      name: exchange_location_exclusion
    - description: Comma-separated list of public folders to include, or you can use the value "All" to include all.
      isArray: true
      name: public_folder_location
    - description: Comma-separated list of SharePoint online sites to include. You can identify the sites by their URL value, or you can use the value "All" to include all sites.
      isArray: true
      name: share_point_location
    - description: Comma-separated list of SharePoint online sites to exclude when you use the value "All" for the share_point_location argument. You can identify the sites by their URL value.
      isArray: true
      name: share_point_location_exclusion
    description: Create compliance search in the Security & Compliance Center.
    name: o365-sc-new-search
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery
      description: Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy
      description: Security and compliance search creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime
      description: Security and compliance search creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Description
      description: Security and compliance search description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Errors
      description: Security and compliance search errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation
      description: Security and compliance search exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Identity
      description: Security and compliance search identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.IsValid
      description: Whether the security and compliance search is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Items
      description: The number of security and compliance search scanned items.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime
      description: Security and compliance search job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobId
      description: Security and compliance search job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobRunId
      description: Security and compliance search job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime
      description: Security and compliance search job run start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime
      description: Security and compliance search last modification time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LogLevel
      description: Security and compliance search Azure log level.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Name
      description: Security and compliance search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation
      description: Security and compliance search OneDrive locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion
      description: Security and compliance search OneDrive locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation
      description: Security and compliance search public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion
      description: Security and compliance search public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunBy
      description: Security and compliance search last run by UPN (Email representation).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId
      description: Security and compliance search run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation
      description: Security and compliance search SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Size
      description: Security and compliance search bytes results size.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Status
      description: Security and compliance search status.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.TenantId
      description: Security and compliance search Tenant ID.
      type: String
  - arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    - description: Modify the text search string or a query that is formatted using the Keyword Query Language (KQL).
      name: kql
    - description: Modify the description for the compliance search.
      name: description
    - description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      name: allow_not_found_exchange_locations
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Comma-separated list of added mailboxes/distribution groups to include, or you can use the value "All" to include all mailboxes.
      isArray: true
      name: add_exchange_location
    - description: Comma-separated list of added mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location (used in create new compliance search) or the add_exchange_location argument.
      isArray: true
      name: add_exchange_location_exclusion
    - description: Comma-separated list of added public folders to include, or you can use the value "All" to include all.
      isArray: true
      name: add_public_folder_location
    - description: Comma-separated list of added SharePoint online sites to include. You identify the sites by their URL value, or you can use the value "All" to include all sites.
      isArray: true
      name: add_share_point_location
    - description: Comma-separated list of added SharePoint online sites to exclude when you use the value "All" for the exchange_location (used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value.
      isArray: true
      name: add_share_point_location_exclusion
    - description: Comma-separated list of removed mailboxes/distribution group to include.
      isArray: true
      name: remove_exchange_location
    - description: Comma-separated list of removed mailboxes/distribution group to exclude when you use the value "All" for the exchange_location (Used in create new compliance search) or the add_exchange_location argument.
      isArray: true
      name: remove_exchange_location_exclusion
    - description: Comma-separated list of removed public folders to include.
      isArray: true
      name: remove_public_folder_location
    - description: Comma-separated list of removed SharePoint online sites to include. You can identify the sites by their URL value.
      isArray: true
      name: remove_share_point_location
    - description: Comma-separated list of removed SharePoint online sites to exclude when you use the value "All" for the exchange_location (Used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value.
      isArray: true
      name: remove_share_point_location_exclusion
    description: Modifies non-running compliance searches in the Security & Compliance Center.
    name: o365-sc-set-search
  - arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    description: Remove compliance search by name from the Security & Compliance Center.
    name: o365-sc-remove-search
  - description: List compliance searches in the Security & Compliance Center.
    name: o365-sc-list-search
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery
      description: Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy
      description: Security and compliance search creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime
      description: Security and compliance search creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Description
      description: Security and compliance search description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Errors
      description: Security and compliance search errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation
      description: Security and compliance search exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Identity
      description: Security and compliance search identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.IsValid
      description: Whether the security and compliance search is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Items
      description: The number of security and compliance search scanned items.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime
      description: Security and compliance search job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobId
      description: Security and compliance search job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobRunId
      description: Security and compliance search job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime
      description: Security and compliance search job run start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime
      description: Security and compliance search last modification time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LogLevel
      description: Security and compliance search Azure log level.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Name
      description: Security and compliance search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation
      description: Security and compliance search OneDrive locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion
      description: Security and compliance search OneDrive locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation
      description: Security and compliance search public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion
      description: Security and compliance search public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunBy
      description: Security and compliance search last run by UPN (Email representation).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId
      description: Security and compliance search run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation
      description: Security and compliance search SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Size
      description: Security and compliance search bytes results size.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Status
      description: Security and compliance search status.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.TenantId
      description: Security and compliance search Tenant ID.
      type: String
  - arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    - description: The maximum number of results to return. If you want to return all requests that match the query, use "-1" for the value of this argument.
      name: limit
      defaultValue: 100
    - description: Whether to include mailboxes which have no results in results entry context.
      name: all_results
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - description: Whether to export search results as json file to war-room.
      name: export
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - description: Show search statistics. Default is "false".
      name: statistics
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    description: Gets compliance search by name from the Security & Compliance Center.
    name: o365-sc-get-search
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery
      description: Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy
      description: Security and compliance search creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime
      description: Security and compliance search creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Description
      description: Security and compliance search description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Errors
      description: Security and compliance search errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation
      description: Security and compliance search exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Identity
      description: Security and compliance search identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.IsValid
      description: Whether the security and compliance search is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Items
      description: Number of security and compliance search scanned items.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime
      description: Security and compliance search job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobId
      description: Security and compliance search job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobRunId
      description: Security and compliance search job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime
      description: Security and compliance search job run start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime
      description: Security and compliance search last modification time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LogLevel
      description: Security and compliance search the Azure log level.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Name
      description: Security and compliance search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation
      description: Security and compliance search OneDrive locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion
      description: Security and compliance search OneDrive locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation
      description: Security and compliance search public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion
      description: Security and compliance search public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunBy
      description: Security and compliance search last run by UPN (Email representation).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId
      description: Security and compliance search run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation
      description: Security and compliance search SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Size
      description: Security and compliance search bytes results size.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Status
      description: Security and compliance search status.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.TenantId
      description: Security and compliance search Tenant ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Location
      description: Security and compliance search result location.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.ItemsCount
      description: The number of security and compliance search results in location.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Size
      description: The byte size of the security and compliance search results in location.
      type: Number
  - arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    description: Starts stopped, completed, or not started compliance search in the Security & Compliance Center.
    name: o365-sc-start-search
  - arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    description: Stop running compliance search in the Security & Compliance Center.
    name: o365-sc-stop-search
  - arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    - description: 'Search action to perform. Possible values are: "Preview" and "Purge". Default is "Preview".'
      name: action
      auto: PREDEFINED
      defaultValue: "Preview"
      predefined:
      - "Preview"
      - "Purge"
    - description: 'Purge type. Possible values are: "Soft Delete" and "HardDelete". Default is "SoftDelete".'
      name: purge_type
      auto: PREDEFINED
      defaultValue: "SoftDelete"
      predefined:
      - SoftDelete
      - HardDelete
    description: After you create a content search using the o365-sc-new-search command and run it using the o365-sc-start-search command, you assign a search action to the search using the o365-sc-new-search-action command.
    name: o365-sc-new-search-action
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action
      description: Security and compliance search action type. Either "Purge" or "Preview".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy
      description: Security and compliance search action creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime
      description: Security and compliance search action creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description
      description: Security and compliance search action description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors
      description: Security and compliance search action errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId
      description: Security and compliance search action job ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId
      description: Security and compliance search action run ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation
      description: Security and compliance search action exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion
      description: Security and compliance search action exchange locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity
      description: Security and compliance search action identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid
      description: Whether the security and compliance search action is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime
      description: Security and compliance search action job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId
      description: Security and compliance search action job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId
      description: Security and compliance search action job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime
      description: Security and compliance search action job start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime
      description: Security and compliance search action last modified time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name
      description: Security and compliance search action name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation
      description: Security and compliance search action public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion
      description: Security and compliance search action public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry
      description: Whether to retry if the search action failed.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy
      description: Security and compliance search action run by UPN (email address).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId
      description: Security and compliance search action run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName
      description: Security and compliance search action search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation
      description: Security and compliance search action SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion
      description: Security and compliance search action SharePoint locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status
      description: Security and compliance search action status. Either "Started" or "Completed".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId
      description: Security and compliance search action Tenant ID.
      type: String
  - arguments:
    - description: The name of the compliance search action.
      name: search_action_name
      required: true
    description: Removes a compliance search action by searching for the action name in the Security & Compliance Center.
    name: o365-sc-remove-search-action
  - description: Lists compliance search actions from the Security & Compliance Center.
    name: o365-sc-list-search-action
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action
      description: Security and compliance search action type. Either "Purge or "Preview".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy
      description: Security and compliance search action creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime
      description: Security and compliance search action creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description
      description: Security and compliance search action description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors
      description: Security and compliance search action errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId
      description: Security and compliance search action job ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId
      description: Security and compliance search action run ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation
      description: Security and compliance search action exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion
      description: Security and compliance search action exchange locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity
      description: Security and compliance search action identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid
      description: Whether the security and compliance search action is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime
      description: Security and compliance search action job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId
      description: Security and compliance search action job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId
      description: Security and compliance search action job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime
      description: Security and compliance search action job start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime
      description: Security and compliance search action last modified time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name
      description: Security and compliance search action name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation
      description: Security and compliance search action public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion
      description: Security and compliance search action public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry
      description: Whether to retry if the search action failed.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy
      description: Security and compliance search action run by UPN (email address).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId
      description: Security and compliance search action run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName
      description: Security and compliance search action search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation
      description: Security and compliance search action SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion
      description: Security and compliance search action SharePoint locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status
      description: Security and compliance search action status (Started/Completed).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId
      description: Security and compliance search action Tenant ID.
      type: String
  - arguments:
    - description: The name of the compliance search action.
      name: search_action_name
      required: true
    - description: The maximum number of results to return. If you want to return all requests that match the query, use "-1" for the value of this argument.
      name: limit
      defaultValue: 100
    - description: Whether to export search results as json file to war-room.
      name: export
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - description: Whether to print the results in the War Room. Default is "false".
      name: results
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    description: Gets compliance search action from the Security & Compliance Center.
    name: o365-sc-get-search-action
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action
      description: Security and compliance search action type. Either "Purge" or "Preview".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy
      description: Security and compliance search action creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime
      description: Security and compliance search action creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description
      description: Security and compliance search action description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors
      description: Security and compliance search action errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId
      description: Security and compliance search action job ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId
      description: Security and compliance search action run ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation
      description: Security and compliance search action exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion
      description: Security and compliance search action exchange locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity
      description: Security and compliance search action identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid
      description: Whether the security and compliance search action is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime
      description: Security and compliance search action job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId
      description: Security and compliance search action job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId
      description: Security and compliance search action job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime
      description: Security and compliance search action job start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime
      description: Security and compliance search action last modified time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name
      description: Security and compliance search action name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation
      description: Security and compliance search action public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion
      description: Security and compliance search action public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Location
      description: Security and compliance search action result location.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ItemCount
      description: Security and compliance search action result item count.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.TotalSize
      description: Security and compliance search action result total size.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.FailedCount
      description: Security and compliance search action result failed count.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Sender
      description: Security and compliance search action result mail sender.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Subject
      description: Security and compliance search action result subject.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Type
      description: Security and compliance search action result type.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Size
      description: Security and compliance search action result size.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ReceivedTime
      description: Security and compliance search action result received time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.DataLink
      description: Security and compliance search action data link.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry
      description: Whether to retry if the search action failed.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy
      description: Security and compliance search action run by UPN (email address).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId
      description: Security and compliance search action run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName
      description: Security and compliance search action search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation
      description: Security and compliance search action SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion
      description: Security and compliance search action SharePoint locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status
      description: Security and compliance search action status. Either "Started" or "Completed".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId
      description: Security and compliance search action Tenant ID.
      type: String
  dockerimage: demisto/powershell-ubuntu:7.3.0.49844
  runonce: false
  script: '-'
  type: powershell
fromversion: 5.5.0
tests:
- O365-SecurityAndCompliance-Test
supportedModules:
- agentix
- xsiam
- edr