Microsoft Security & Compliance Center - Content Search Integration

⚠️ Deprecation Notice

This integration is deprecated. Use the Microsoft Graph Security integration for equivalent functionality.

Note: The legacy content search solution is retired. Content searches are now performed within the context of an eDiscovery case.

Commands Replacement

All functionality from O365 - Security And Compliance - Content Search v2 has been migrated to the Microsoft Graph Security integration. Use Microsoft Graph Security for the supported commands listed below.

Compliance cases

• o365-sc-compliance-case-create → Use msg-create-ediscovery-case. Microsoft Learn: Create eDiscovery case
• o365-sc-compliance-case-delete → Use msg-delete-ediscovery-case. Microsoft Learn: Delete eDiscovery case
• o365-sc-compliance-case-list → Use msg-list-ediscovery-cases. Microsoft Learn: List eDiscovery cases

Hold policies

• o365-sc-case-hold-policy-create → Use msg-create-ediscovery-case-hold-policy. Microsoft Learn: Create hold policy (legal hold)
• o365-sc-case-hold-policy-delete → Use msg-delete-ediscovery-case-hold-policy. Microsoft Learn: Delete hold policy
• o365-sc-case-hold-policy-get → Use msg-list-ediscovery-case-hold-policy. Microsoft Learn: List hold policies / Microsoft Learn: Get hold policy
• o365-sc-case-hold-policy-set → Use msg-update-ediscovery-case-hold-policy. Microsoft Learn: Update hold policy

Hold rules

• o365-sc-case-hold-rule-create → Use msg-create-ediscovery-case-hold-policy (use the contentQuery property). Microsoft Learn: Create hold policy
• o365-sc-case-hold-rule-delete → Use msg-delete-ediscovery-case-hold-policy. Microsoft Learn: Delete hold policy
• o365-sc-case-hold-rule-list → Use msg-list-ediscovery-case-hold-policy (see the contentQuery property). Microsoft Learn: List hold policies

Legacy Content Search (case-based in Graph eDiscovery)

Note: The legacy content search solution is retired. Content searches are now performed within the context of an eDiscovery case.

• o365-sc-get-search → Use msg-list-ediscovery-searchs. Microsoft Learn: List searches in a case
• o365-sc-list-search → Use msg-list-ediscovery-searchs. Microsoft Learn: List searches in a case
• o365-sc-new-search → Use msg-create-ediscovery-search. Microsoft Learn: Create search
• o365-sc-remove-search → Use msg-delete-ediscovery-search. Microsoft Learn: Delete search
• o365-sc-set-search → Use msg-update-ediscovery-search. Microsoft Learn: Update search

Search execution and actions

• o365-sc-start-search → Use msg-run-estimate-statistics. Note: In Microsoft Graph eDiscovery, searches do not have a separate “start” command. Instead, a search is executed when you run the estimate command.
  Microsoft Learn: Estimate statistics

• o365-sc-stop-search → There is no Stop-ComplianceSearch equivalent in Microsoft Graph. In the new eDiscovery model a search never “runs” by itself. Microsoft Learn: eDiscovery search resource type

• o365-sc-new-search-action → Use:
  • msg-run-estimate-statistics. Microsoft Learn: Estimate statistics
  • msg-purge-ediscovery-data. Microsoft Learn: Purge data
  • msg-export-result-ediscovery-data. Microsoft Learn: Export results
• o365-sc-remove-search-action → Use msg-purge-ediscovery-data. Microsoft Learn: Purge data
• o365-sc-get-search-action → Use msg-list-case-operation. Microsoft Learn: Get case operation
• o365-sc-list-search-action → Use msg-list-case-operation. Microsoft Learn: Get case operation

This integration allows you to manage and interact with Microsoft Security & Compliance Center’s content search capabilities. You can perform comprehensive searches across your organization’s emails, SharePoint sites, OneDrive accounts, and more. Actions like previewing and deleting emails are supported, making it easier to manage potential security threats.

This integration has been developed and tested with the Security & Compliance Center.

The Security and Compliance PowerShell module relies on legacy eDiscovery. We recommend transitioning to the new eDiscovery implementation, which is built on the Microsoft Graph API Microsoft Graph Security integration.

Key Features

• Content Search Management: Create, modify, retrieve, list, remove, and trigger content searches within the Security & Compliance Center.
• Search Actions: Perform actions such as previewing and purging (deleting) emails identified in content searches.

Playbooks

• O365 - Security and Compliance - Search and Delete: Initiates a compliance search and, if configured, deletes or previews identified emails.
• O365 - Security and Compliance - Search: Initiates a compliance search to locate emails with attributes matching those of a malicious email.
• O365 - Security and Compliance - Search Action - Delete: Deletes emails found by the search.
• O365 - Security and Compliance - Search Action - Preview: Provides a preview of emails identified by the search.

Permissions and Authentication Setup

Overview

This section describes how to configure permissions for the integration, supporting both App-only Authentication and Delegated User Authentication.

App Authentication (App-Only)

To set up the integration and register the application in Azure, you will need to perform the following three primary steps:

1. App Registration and Permission Configuration: Register a new application in Entra ID and configure necessary permissions.
2. Authentication Configuration: Enable public client flows and create an app secret.
3. Role Setup: Assign the required roles for the App Service Principal to function correctly.
   Detailed instructions for each step are provided below.

1. App Registration and Permission Configuration

1. Navigate to Azure Portal: Go to the Azure Portal and sign in with your administrator account.
2. Access App Registrations: In the left-hand navigation pane, select Entra ID > App registrations.
3. Register a New App: Click New registration, provide a name, and register the app.
4. Add API Permissions:
   • Under Manage, select API permissions > Add a permission.
     • Select APIs my organization uses.
     • Search for “Office 365 Exchange Online”.
     • Select Delegated permissions and search for Exchange.Manage.
     • Check the box and click Add permissions.
   • Again select Add a permission.
     • Select APIs my organization uses.
     • Search for “Microsoft Graph”.
     • Select Delegated permissions and search for eDiscovery.ReadWrite.All.
     • Check the box and click Add permissions.
   • Ensure the permissions are gra

2. Authentication Configuration

1. Navigate to Authentication Settings: In your app registration, click on Authentication -> Settings.
2. Enable Public Client Flows:
   • Set Allow public client flows to Enabled.
   • Click Save to apply the changes.

3. Role Setup

1. In the Azure portal, go to Microsoft Entra roles and administrators.
2. Locate the Required Role
   • Search for the role Compliance Administrator.
   • Select the role to open its details page.
3. Add Role Assignment
   • Click Add assignments.
   • Select Members.
   • Search for your new application name.
   • Select the application and confirm the assignment.

Delegated User Authentication

This section describes how to configure delegated authentication using a user account. You may either create a dedicated service account for the integration or use an existing user account (including an administrator account). If an existing user is used, you can skip the user creation step and proceed directly to the MFA and role assignment steps.

1. Create a Dedicated User (Microsoft Entra ID)

Create a new user account to serve as a dedicated service account for the integration.

• Go to the Azure Portal and sign in with an organization administrator account.
• Navigate to Entra ID → Users → New user.
• Create a new user and define:
  • User Principal Name (UPN) – this will be used in the integration configuration
  • Display name
  • Password – store this securely

2. Disable Multi-Factor Authentication (MFA)

For delegated authentication to work, MFA must be disabled for this service account.

• Go to the Microsoft 365 Admin Center and sign in with an organization administrator account.
• Navigate to Users → Active users.
• At the top menu, select Multi-factor authentication.
• Locate the user and verify that the MFA status is set to Disabled.

3. Purview Role Assignment (Microsoft Purview Portal)

Grant the service account the required permissions to run Security & Compliance PowerShell cmdlets.

• Sign in to the Microsoft Purview Portal using an organization administrator account.
• Under Setting, navigate to Roles & scopes → Role groups.
• Locate the built-in eDiscovery Manager role group.
• Select Copy to create a new custom role group.
• Provide a name and description.
• In the Roles section, add the Search and Purge role to the custom role group.
• In the Users section, add your user.
• Review the configuration and complete the setup.

Note: Role assignment propagation may take up to one hour.

Known Endpoints

More information available here.

Configure SecurityAndComplianceV2 in Cortex

1. Navigate to one of the following:
   • Cortex XSOAR 6: Settings > Integrations
   • Cortex XSOAR 8: Settings & Info > Settings > Integrations > Instances
   • Cortex XSIAM: Settings > Configurations > Automation & Feed Integrations
2. Search for O365 - Security And Compliance - Content Search v2.
3. Authentication / Authorization methods:
   • App-only (OAuth2.0) using device code Authentication -
     1. Fill in the UPN, App ID, and Tenant ID parameters in the integration configuration.
     2. Run the o365-sc-auth-start command and follow the instructions.
     3. For testing completion of authorization process run the o365-sc-auth-test command.
   • Delegated User Authentication -
     1. Fill in the UPN parameter in the integration configuration.
     2. Fill in the ‘UPN Password’ parameter - the user’s Microsoft 365 password (the regular sign-in password for that UPN).
     3. For testing completion of authorization process run the o365-sc-auth-test command.
     4. The following commands are only available when using the Delegated User Authentication method, as per the Microsoft Update:
        • o365-sc-new-search-action
        • o365-sc-case-hold-policy-create
        • o365-sc-case-hold-policy-set
        • o365-sc-case-hold-policy-delete
        • o365-sc-case-hold-rule-create
        • o365-sc-case-hold-rule-delete
   • Note - If a UPN Password is provided:
     • Even if the password is incorrect, the integration will attempt to authenticate using it.
     • In this case, all connections to Microsoft Security and Compliance PowerShell will use interactive delegated authentication.

4. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   UPN/Email	The email address (UPN) of the user account for the integration.	True
   UPN Password	Password for the specified UPN. Required when using interactive delegated authentication.	False
   App ID	The application (client) ID from Azure	False
   Tenant ID	The directory (tenant) ID from Azure.	False
   Organization	The organization name for the Security & Compliance Center.	False
   Insecure	Trust any certificate (not secure).	False

• Expected Output:

  Security and Compliance - Authorize Instructions App-only (OAuth2.0) using device code Authentication

  1. To sign in, open https://microsoft.com/devicelogin in a web browser and enter the code XXXXXXX to authenticate.
  2. Run the !o365-sc-auth-complete command in the War Room.
  3. Test OAuth2.0 authorization by running the !o365-sc-auth-test command.

  Security and Compliance - Authorize Instructions Delegated User Authentication

  1. Test ok!

Troubleshooting and Testing

Common Issues and Solutions

Response status code does not indicate success: 404 Not Found

Scenario: When running the !o365-sc-auth-start command, you may encounter the error message: “Response status code does not indicate success: 404 Not Found.”

Solution:
Verify Required Parameters: Ensure that all required parameters for App-only (using device code) Authentication in the integration instance configuration are correctly filled out. This includes:

• UPN/Email: The email address (UPN) of the user account for the integration.
• App ID: The application (client) ID from Azure.
• Tenant ID: The directory (tenant) ID from Azure.
• Organization: The organization name for the Security & Compliance Center.

Missing or incorrect values in these fields can cause a 404 error, as the integration might be attempting to connect to an incorrect or non-existent endpoint.

Additional Steps:

• Check the ConnectionUri: Verify that the ConnectionUri in your configuration matches the environment you are operating in (e.g., Microsoft 365, GCC High, DoD, etc.).
• Review Endpoint Configuration: Ensure that the AzureADAuthorizationEndpointUri is correctly set according to your environment.

Response status code does not indicate success: 400 Bad Request

Scenario: When running the !o365-sc-auth-start command, you may encounter the error message: “Response status code does not indicate success: 400 Bad Request.”

Solution:
Check Parameters for Accuracy: A 400 Bad Request error often indicates that there is a problem with the request sent to the server. Double-check the following:

• App ID and Tenant ID: Ensure these are correctly copied from your Azure app registration.
• UPN/Email: Ensure that the email address is correctly formatted and belongs to a user with the necessary permissions.

Additional Steps:
Test with a Different Account: If possible, try using a different user account to verify if the issue is related to specific user permissions.

Failed OAuth2.0 Authorization

Scenario: After running the !o365-sc-auth-start command, the authorization process fails, and the integration cannot authenticate with the Security & Compliance Center.

Solution:

• Double-Check App Permissions: Make sure that the app registration in Azure has the necessary permissions, specifically Exchange.ManageAsApp.
• Grant Admin Consent: Ensure that admin consent has been granted for the required permissions. Without this, the application cannot function correctly.
• Review Authentication Setup: Ensure that “Allow public client flows” is enabled in the Azure app registration settings under Authentication.

Additional Steps:

• Use the !o365-sc-auth-test Command: Run this command to verify if the integration can successfully authenticate. If this test fails, revisit the app registration settings and verify all configurations.

Failed Delegated User Authentication

Scenario: You Filled out the ‘UPN’ and ‘UPN Password’ integration parameters and after running the !o365-sc-auth-test command, the authorization process fails, and you get the error ‘you must use multi-factor authentication to access …’.

Solution:

• Double-Check you disabled MFA:
  1. Go to the Microsoft 365 Admin Center and sign in with your administrator account.
  2. Under Users, select Active users.
  3. At the top, click Multi-factor authentication.
  4. In the list that appears, find your user and check the Multi-Factor Auth Status column is disabled.

Additional Steps:

• Use the !o365-sc-auth-test Command: Run this command to verify if the integration can successfully authenticate. If this test fails, revisit the app registration settings and verify all configurations.

Testing the Integration

1. Test Basic Connectivity:
   Use the !o365-sc-auth-test command to confirm that the integration can successfully authenticate with the Security & Compliance Center.

2. Run a Simple Search:
   Execute the !o365-sc-search command with basic parameters to ensure the integration can perform a search operation. This helps verify that the configuration is correct and the integration can communicate with the Security & Compliance Center.

3. Check Logs and Outputs:
   After running test commands, review the logs and command outputs in the War Room for any errors or warnings. This can provide additional insights into what might be going wrong.

4. Review Azure Logs:
   If issues persist, review the logs in Azure to identify any access issues or authentication errors. This can help diagnose problems related to Azure AD configuration.

Additional Resources

• Microsoft 365 Compliance Documentation:
  Troubleshoot content search issues

• Azure AD Troubleshooting:

  • Azure AD Sign-in Logs
  • OAuth2.0 Authorization Troubleshooting

Commands

You can execute these commands from the Cortex XSIAM/XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

o365-sc-auth-start

OAuth2.0 - Start authorization.

Base Command

o365-sc-auth-start

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

#### Human Readable Output

>## Security And Compliance - Authorize instructions
>
>1. To sign in, use a web browser to open the page [https://microsoft.com/devicelogin](https://microsoft.com/devicelogin) and enter the code **XXXXXXX** to authenticate.
>2. Run the ***!o365-sc-auth-complete*** command in the War Room.

### o365-sc-auth-complete

***
OAuth2.0 - Complete authorization.

#### Base Command

`o365-sc-auth-complete`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!o365-sc-auth-complete```

#### Human Readable Output

>Your account **successfully** authorized!

### o365-sc-auth-test

***
OAuth2.0 - Test authorization.

#### Base Command

`o365-sc-auth-test`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!o365-sc-auth-test```

#### Human Readable Output

>**Test ok!**

### o365-sc-new-search

***
Create compliance search in the Security & Compliance Center.

#### Base Command

`o365-sc-new-search`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| search_name | The name of the compliance search. If not specified, will have the prefix "XSOAR-" followed by the GUID e.g., XSOAR-d6228fd0-756b-4e4b-8721-76776df91526. | Required |
| case | The name of a Core eDiscovery case to associate with the new compliance search. | Optional |
| kql | Text search string or a query that is formatted using the Keyword Query Language (KQL). [Tips for finding messages to remove using KQL](#tips-for-finding-messages-to-remove)
| Optional |
| description | Description of the compliance search. | Optional |
| allow_not_found_exchange_locations | Whether to include mailboxes other than regular user mailboxes in the compliance search. Default is "false". | Optional |
| exchange_location | Comma-separated list of mailboxes/distribution groups to include, or you can use the value "All" to include all. | Optional |
| exchange_location_exclusion | Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter. Deprecated since Microsoft is supporting it only on-premise. | Optional |
| public_folder_location | Comma-separated list of public folders to include, or you can use the value "All" to include all. | Optional |
| share_point_location | Comma-separated list of SharePoint online sites to include. You can identify the sites by their URL value, or you can use the value "All" to include all sites. | Optional |
| share_point_location_exclusion | Comma-separated list of SharePoint online sites to exclude when you use the value "All" for the share_point_location argument. You can identify the sites by their URL value. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled | Boolean | Whether to include mailboxes other than regular user mailboxes in the compliance search. |
| O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled | Boolean | Whether the Azure Batch Framework is enabled for job processing. |
| O365.SecurityAndCompliance.ContentSearch.Search.CaseId | String | Identity of a Core eDiscovery case which is associated with the compliance search. |
| O365.SecurityAndCompliance.ContentSearch.Search.CaseName | String | Name of a Core eDiscovery case which is associated with the compliance search. |
| O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery | String | Compliance text search string or a query that is formatted using the Keyword Query Language \(KQL\). |
| O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy | String | Security and compliance search creator. |
| O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime | Date | Security and compliance search creation time. |
| O365.SecurityAndCompliance.ContentSearch.Search.Description | String | Security and compliance search description. |
| O365.SecurityAndCompliance.ContentSearch.Search.Errors | String | Security and compliance search errors. |
| O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation | String | Security and compliance search exchange locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.Identity | String | Security and compliance search identity. |
| O365.SecurityAndCompliance.ContentSearch.Search.IsValid | Boolean | Whether the security and compliance search is valid. |
| O365.SecurityAndCompliance.ContentSearch.Search.Items | Number | The number of security and compliance search scanned items. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime | Date | Security and compliance search job end time. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobId | String | Security and compliance search job ID. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobRunId | String | Security and compliance search job run ID. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime | Date | Security and compliance search job run start time. |
| O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime | Date | Security and compliance search last modification time. |
| O365.SecurityAndCompliance.ContentSearch.Search.LogLevel | String | Security and compliance search Azure log level. |
| O365.SecurityAndCompliance.ContentSearch.Search.Name | String | Security and compliance search name. |
| O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation | String | Security and compliance search OneDrive locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion | String | Security and compliance search OneDrive locations to exclude. |
| O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation | String | Security and compliance search public folder locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion | String | Security and compliance search public folder locations to exclude. |
| O365.SecurityAndCompliance.ContentSearch.Search.RunBy | String | Security and compliance search last run by UPN \(Email representation\). |
| O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId | String | Security and compliance search run space ID. |
| O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation | String | Security and compliance search SharePoint locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.Size | Number | Security and compliance search bytes results size. |
| O365.SecurityAndCompliance.ContentSearch.Search.Status | String | Security and compliance search status. |
| O365.SecurityAndCompliance.ContentSearch.Search.TenantId | String | Security and compliance search Tenant ID. |

#### Command Example

```!o365-sc-new-search search_name="example" exchange_location="user1@demistodev.onmicrosoft.com,user2@demistodev.onmicrosoft.com" allow_not_found_exchange_locations=true kql="Rodrigo"```

#### Context Example

```json
{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "Search": {
                    "AllowNotFoundExchangeLocationsEnabled": true,
                    "AzureBatchFrameworkEnabled": false,
                    "CaseId": null,
                    "CaseName": "",
                    "ContentMatchQuery": "Rodrigo",
                    "CreatedBy": "XSOAR-user",
                    "CreatedTime": "2020-11-29T07:12:46.5943533Z",
                    "Description": "Short description",
                    "Errors": null,
                    "ExchangeLocation": [
                        "test1@onmicrosoft.com",
                        "test2@onmicrosoft.com"
                    ],
                    "ExchangeLocationExclusion": [],
                    "Identity": "xxxxx",
                    "IsValid": true,
                    "Items": 0,
                    "JobEndTime": null,
                    "JobId": "xxxxx",
                    "JobRunId": null,
                    "JobStartTime": null,
                    "LastModifiedTime": "2020-11-29T07:12:46.5943533Z",
                    "LogLevel": "Suppressed",
                    "Name": "example",
                    "OneDriveLocation": null,
                    "OneDriveLocationExclusion": null,
                    "PublicFolderLocation": null,
                    "PublicFolderLocationExclusion": null,
                    "RunBy": "",
                    "RunspaceId": null,
                    "SharePointLocation": null,
                    "SharePointLocationExclusion": null,
                    "Size": 0,
                    "Status": "NotStarted",
                    "SuccessResults": null,
                    "TenantId": "xxxxx"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - New search ‘example’ created

ContentMatchQuery	CreatedBy	Description	LastModifiedTime	Name
Rodrigo	XSOAR-user	Short description	11/29/2020 7:12:46 AM	example

o365-sc-set-search

Modifies non-running compliance searches in the Security & Compliance Center.

Base Command

o365-sc-set-search

Input

Context Output

There is no context output for this command.

Command Example

!o365-sc-set-search search_name="example" remove_exchange_location="test2@demistodev.onmicrosoft.com"

Human Readable Output

Security And Compliance - Search example modified!

o365-sc-remove-search

Remove compliance search by name from the Security & Compliance Center.

Base Command

o365-sc-remove-search

Input

Context Output

There is no context output for this command.

Command Example

!o365-sc-remove-search search_name="example"

Human Readable Output

Security And Compliance - Search example removed!

o365-sc-list-search

List compliance searches in the Security & Compliance Center.

Base Command

o365-sc-list-search

Input

There are no input arguments for this command.

Context Output

Command Example

#### Context Example

```json
{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "Search": [
                    {
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "ContentMatchQuery": "subject:test",
                        "CreatedBy": "XSOAR-user1",
                        "CreatedTime": "2019-08-22T06:43:48.747",
                        "Description": "Short description",
                        "Errors": null,
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "Items": 0,
                        "JobEndTime": "2019-09-05T13:21:11.563",
                        "JobId": "xxxx",
                        "JobRunId": null,
                        "JobStartTime": "2019-09-05T13:20:34.633",
                        "LastModifiedTime": "2019-08-22T06:43:48.747",
                        "LogLevel": "Suppressed",
                        "Name": "example1",
                        "OneDriveLocation": null,
                        "OneDriveLocationExclusion": null,
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "RunBy": "XSOAR-user1",
                        "RunspaceId": null,
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Size": 0,
                        "Status": "Completed",
                        "SuccessResults": null,
                        "TenantId": "xxxx"
                    },
                    {
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "ContentMatchQuery": "subject:Incident Summary Report",
                        "CreatedBy": "XSOAR-user2",
                        "CreatedTime": "2020-01-08T00:44:30.94",
                        "Description": "Short description",
                        "Errors": null,
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "Items": 0,
                        "JobEndTime": "2020-01-08T00:45:13.433",
                        "JobId": "xxxxx",
                        "JobRunId": null,
                        "JobStartTime": "2020-01-08T00:44:33.717",
                        "LastModifiedTime": "2020-01-08T00:44:30.94",
                        "LogLevel": "Suppressed",
                        "Name": "example2",
                        "OneDriveLocation": null,
                        "OneDriveLocationExclusion": null,
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "RunBy": "XSOAR-user2",
                        "RunspaceId": null,
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Size": 0,
                        "Status": "Completed",
                        "SuccessResults": null,
                        "TenantId": "xxxxx"
                    }
                ]
            }
        }
    }
}

Human Readable Output

Security And Compliance - Search configurations

CreatedBy	Description	LastModifiedTime	Name	RunBy
XSOAR-user1	Short description	8/22/2019 6:43:48 AM	example1	XSOAR-user1
XSOAR-user2	Short description	1/8/2020 12:44:30 AM	example2	XSOAR-user2

o365-sc-get-search

Gets compliance search by name from the Security & Compliance Center.

Base Command

o365-sc-get-search

Input

Context Output

Command Example

!o365-sc-get-search search_name="example"

Context Example

{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "Search": {
                    "Errors": "", 
                    "AzureBatchFrameworkEnabled": false,
                    "TenantId": "xxxxx", 
                    "SharePointLocationExclusion": null, 
                    "JobStartTime": "2020-11-29T07:20:59.37", 
                    "CreatedTime": "2020-11-29T07:18:04.283", 
                    "OneDriveLocation": null, 
                    "PublicFolderLocation": null, 
                    "Status": "Completed", 
                    "CaseName": "", 
                    "AllowNotFoundExchangeLocationsEnabled": false, 
                    "LogLevel": "Suppressed", 
                    "JobRunId": null, 
                    "CaseId": null, 
                    "JobId": "xxxxx", 
                    "SuccessResults": {
                        "ItemsCount": "122303", 
                        "Location": "user@onmicrosoft.com", 
                        "Size": "12339007379"
                    }, 
                    "LastModifiedTime": "2020-11-29T07:20:43.283", 
                    "Identity": "1d130723-fe0a-4726-6d2a-08d89437520e", 
                    "Name": "example", 
                    "Items": 122303, 
                    "ExchangeLocation": [
                        "user@onmicrosoft.com"
                    ], 
                    "RunBy": "XSOAR-user", 
                    "Description": "Short description", 
                    "ExchangeLocationExclusion": [], 
                    "IsValid": true, 
                    "PublicFolderLocationExclusion": null, 
                    "SharePointLocation": null, 
                    "CreatedBy": "XSOAR-user", 
                    "JobEndTime": "2020-11-29T07:22:01.99", 
                    "RunspaceId": null, 
                    "Size": 12339007379, 
                    "OneDriveLocationExclusion": null, 
                    "ContentMatchQuery": "Rodrigo"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - ‘example’ search

CreatedBy	Description	LastModifiedTime	Name	RunBy	Status
XSOAR-user	Short description	2020-11-29T07:20:43.283	example	XSOAR-user	NotStarted

o365-sc-start-search

Starts stopped, completed, or not started compliance search in the Security & Compliance Center.

Base Command

o365-sc-start-search

Input

Context Output

There is no context output for this command.

Command Example

!o365-sc-start-search search_name="example"

Human Readable Output

Security And Compliance - search example started !

o365-sc-stop-search

Stop running compliance search in the Security & Compliance Center.

Base Command

o365-sc-stop-search

Input

Context Output

There is no context output for this command.

Command Example

!o365-sc-stop-search search_name="example"

Human Readable Output

Security And Compliance - search example stopped !

o365-sc-new-search-action

After you create a content search using the o365-sc-new-search command and run it using the o365-sc-start-search command, you assign a search action to the search using the o365-sc-new-search-action command.

Please note that when performing the Delete action, items which are deleted will still follow your EWS365 data retention policies. Some data retention policies will move emails to the “Purges” or “Recoverable Items” folder.

Base Command

o365-sc-new-search-action

Input

Context Output

Command Example

!o365-sc-new-search-action search_name="example" action="Preview"

Context Example

{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "SearchAction": {
                    "Action": "Preview",
                    "AllowNotFoundExchangeLocationsEnabled": false,
                    "AzureBatchFrameworkEnabled": false,
                    "CaseId": null,
                    "CaseName": "",
                    "CreatedBy": "XSOAR-user",
                    "CreatedTime": "2020-11-29T07:23:50.05",
                    "Description": "",
                    "Errors": "",
                    "EstimateSearchJobId": "xxxxx",
                    "EstimateSearchRunId": "xxxxx",
                    "ExchangeLocation": [
                        "user@onmicrosoft.com"
                    ],
                    "ExchangeLocationExclusion": null,
                    "Identity": "xxxxx",
                    "IsValid": true,
                    "JobEndTime": "2020-11-29T07:24:05.76",
                    "JobId": "xxxxx",
                    "JobRunId": "xxxxx",
                    "JobStartTime": "2020-11-29T07:23:50.297",
                    "LastModifiedTime": "2020-11-29T07:23:50.05",
                    "Name": "example_Preview",
                    "PublicFolderLocation": null,
                    "PublicFolderLocationExclusion": null,
                    "Results": null,
                    "Retry": false,
                    "RunBy": "XSOAR-user",
                    "RunspaceId": "xxxxx",
                    "SearchName": "example",
                    "SharePointLocation": null,
                    "SharePointLocationExclusion": null,
                    "Status": "Completed",
                    "TenantId": "xxxxx"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - search action ‘example_Preview’ created

Action	LastModifiedTime	Name	RunBy	SearchName	Status
Preview	11/29/2020 7:23:50 AM	example_Preview	XSOAR-user	example	Completed

o365-sc-remove-search-action

Removes compliance search action by search the action name from the Security & Compliance Center.

Base Command

o365-sc-remove-search-action

Input

Context Output

There is no context output for this command.

Command Example

!o365-sc-remove-search-action search_action_name="example_Preview"

Human Readable Output

Security And Compliance - search action example_Preview removed!

o365-sc-list-search-action

Lists compliance search actions from the Security & Compliance Center.

Base Command

o365-sc-list-search-action

Input

There are no input arguments for this command.

Context Output

Command Example

#### Context Example

```json
{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "SearchAction": [
                    {
                        "Action": "Preview",
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "CreatedBy": "XSOAR-user",
                        "CreatedTime": "2020-10-14T13:45:44.14",
                        "Description": "",
                        "Errors": "",
                        "EstimateSearchJobId": "xxxxx",
                        "EstimateSearchRunId": "xxxxx",
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "JobEndTime": "2020-10-14T13:47:00.103",
                        "JobId": "xxxxx",
                        "JobRunId": "xxxxx",
                        "JobStartTime": "2020-10-14T13:45:58.443",
                        "LastModifiedTime": "2020-10-14T13:45:44.14",
                        "Name": "example_Preview",
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "Results": null,
                        "Retry": false,
                        "RunBy": "XSOAR-user",
                        "RunspaceId": "xxxxx",
                        "SearchName": "example",
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Status": "Completed",
                        "TenantId": "xxxxx"
                    },
                   {
                        "Action": "Purge",
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "CreatedBy": "XSOAR-user1",
                        "CreatedTime": "2020-10-14T13:45:44.14",
                        "Description": "",
                        "Errors": "",
                        "EstimateSearchJobId": "xxxxx",
                        "EstimateSearchRunId": "xxxxx",
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "JobEndTime": "2020-10-14T13:47:00.103",
                        "JobId": "xxxxx",
                        "JobRunId": "xxxxx",
                        "JobStartTime": "2020-10-14T13:45:58.443",
                        "LastModifiedTime": "2020-10-14T13:45:44.14",
                        "Name": "example_Purge",
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "Results": null,
                        "Retry": false,
                        "RunBy": "XSOAR-user1",
                        "RunspaceId": "xxxxx",
                        "SearchName": "Rodrigo-diffrent",
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Status": "Completed",
                        "TenantId": "xxxxx"
                    }
                ]
            }
        }
    }
}

Human Readable Output

Security And Compliance - search actions

Action	JobEndTime	LastModifiedTime	Name	RunBy	SearchName	Status
Preview	10/14/2020 1:47:00 PM	10/14/2020 1:45:44 PM	example_Preview	XSOAR-user	example	Completed
Purge	11/25/2020 10:51:04 AM	11/25/2020 10:50:37 AM	example_Purge	XSOAR-user	example	Completed

o365-sc-get-search-action

Gets compliance search action from the Security & Compliance Center.

Base Command

o365-sc-get-search-action

Input

Context Output

Command Example

!o365-sc-get-search-action search_action_name="example_Preview"

Context Example

{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "SearchAction": {
                    "Action": "Preview",
                    "AllowNotFoundExchangeLocationsEnabled": false,
                    "AzureBatchFrameworkEnabled": false,
                    "CaseId": null,
                    "CaseName": "",
                    "CreatedBy": "XSOAR-user",
                    "CreatedTime": "2020-11-29T07:23:50.05",
                    "Description": "",
                    "Errors": "",
                    "EstimateSearchJobId": "2a967c40-07c3-4903-ed7f-08d89436e9b1",
                    "EstimateSearchRunId": "1d130723-fe0a-4726-6d2a-08d89437520e",
                    "ExchangeLocation": [
                        "user@onmicrosoft.com"
                    ],
                    "ExchangeLocationExclusion": null,
                    "Identity": "xxxxx",
                    "IsValid": true,
                    "JobEndTime": "2020-11-29T07:24:05.76",
                    "JobId": "xxxxx",
                    "JobRunId": "xxxxx",
                    "JobStartTime": "2020-11-29T07:23:50.297",
                    "LastModifiedTime": "2020-11-29T07:23:50.05",
                    "Name": "example_Preview",
                    "PublicFolderLocation": null,
                    "PublicFolderLocationExclusion": null,
                    "Results": [
                        {
                            "DataLink": "data/All/xxxx.eml",
                            "Location": "user@onmicrosoft.com",
                            "ReceivedTime": "11/26/2020 2:59:01 PM",
                            "Sender": "Some user",
                            "Size": "19683",
                            "Subject": "Test1",
                            "Type": "Email"
                        },
                       {
                            "DataLink": "data/All/xxxx.eml",
                            "Location": "user@onmicrosoft.com",
                            "ReceivedTime": "12/26/2020 2:59:01 PM",
                            "Sender": "Some user",
                            "Size": "20225",
                            "Subject": "Test2",
                            "Type": "Email"
                        },
                    ],
                    "Retry": false,
                    "RunBy": "XSOAR-user",
                    "RunspaceId": "xxxxx",
                    "SearchName": "example",
                    "SharePointLocation": null,
                    "SharePointLocationExclusion": null,
                    "Status": "Completed",
                    "TenantId": "xxxxx"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - search action ‘example_Preview’

Action	JobEndTime	LastModifiedTime	Name	RunBy	SearchName	Status
Preview	11/29/2020 7:24:05 AM	11/29/2020 7:23:50 AM	example_Preview	XSOAR-user	example	Completed

Tips for finding messages to remove

• Keyword Query Language (KQL)
  • If you know the exact text or phrase used in the subject line of the message, use the Subject property in the search query, e.g., (subject:give me all ur money).
  • If you know that exact date (or date range) of the message, include the Received property in the search query, e.g., (received:6/13/2021..6/16/2021).
  • If you know who sent the message, include the From property in the search query, e.g., (from:user1@demistodev.onmicrosoft.com).
  • For all the available search properties see: Keyword queries and search conditions for eDiscovery.
• Preview the search results to verify that the search returned only the message (or messages) that you want to delete.
• Use the search estimate statistics (displayed by using the o365-sc-get-search command) to get a count of the total number of emails.

o365-sc-compliance-case-create

Create eDiscovery cases in the Microsoft Purview compliance portal.

Base Command

o365-sc-compliance-case-create

Input

Context Output

o365-sc-compliance-case-list

List different types of compliance cases in the Microsoft Purview compliance portal.

Base Command

o365-sc-compliance-case-list

Input

Context Output

o365-sc-compliance-case-delete

Removes compliance cases from the Microsoft Purview compliance portal.

Base Command

o365-sc-compliance-case-delete

Input

Context Output

There is no context output for this command.

o365-sc-case-hold-policy-create

Creates new case hold policies in the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-policy-create

Input

Context Output

o365-sc-case-hold-policy-get

View existing case hold policies in the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-policy-get

Input

Context Output

o365-sc-case-hold-policy-delete

Removes case hold policies from the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-policy-delete

Input

Context Output

There is no context output for this command.

o365-sc-case-hold-rule-create

Creates new case hold rules in the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-rule-create

Input

Context Output

o365-sc-case-hold-rule-list

View case hold rules in the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-rule-list

Input

Context Output

o365-sc-case-hold-rule-delete

Removes case hold rules from the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-rule-delete

Input

Context Output

There is no context output for this command.

Known Limitations

• Security and compliance integrations do not support Security and compliance on-premise.
• Each security and compliance command creates an IPS-Session (PowerShell session). The security and compliance PowerShell limits the number of concurrent sessions to 3. Since this affects the behavior of multiple playbooks running concurrently it we recommend that you retry failed tasks when using the integration commands in playbooks.
• Proxies are not supported due to a Microsoft limitation.
• Due to a Microsoft limitation, you can perform a search and purge operation on a maximum of 50,000 mailboxes. To work around this limitation, configure multiple instances of the integration each with different permission filtering so that the number of mailboxes in each instance does not exceed 50,000.
• A maximum of 10 items per mailbox can be removed at one time, due to a Microsoft limitiation.
• For more Microsoft known limitations see Limits for eDiscovery search.

o365-sc-case-hold-policy-set

Update inputs for case hold policies.

Base Command

o365-sc-case-hold-policy-set

Input

Context Output

There is no context output for this command.

o365-sc-email-security-search-and-delete-email-office-365-quick-action

Deletes an email for all recipients.
On first run, creates and starts a search (if it already exists – returns its status).
Then runs polling until the deletion is complete.
The force parameter allows creating a new search even if one already exists (default: false).

Base Command

o365-sc-email-security-search-and-delete-email-office-365-quick-action

Input

Context Output