SecurityAndComplianceV2 Deprecated

Deprecated. Use the Microsoft Graph Security integration instead. This integration allows you to manage and interact with Microsoft security and compliance content search.

Email · Microsoft Exchange Online

Details

IDSecurityAndComplianceV2
ProviderMicrosoft
CategoryEmail
From Version5.5.0
Docker Imagedemisto/pwsh-exchangev3:1.0.0.4904712
Supported ModulesAgentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Microsoft Security & Compliance Center - Content Search Integration

⚠️ Deprecation Notice

This integration is deprecated. Use the Microsoft Graph Security integration for equivalent functionality.

Note: The legacy content search solution is retired. Content searches are now performed within the context of an eDiscovery case.

Commands Replacement

All functionality from O365 - Security And Compliance - Content Search v2 has been migrated to the Microsoft Graph Security integration. Use Microsoft Graph Security for the supported commands listed below.

Compliance cases

Hold policies

Hold rules

Legacy Content Search (case-based in Graph eDiscovery)

Note: The legacy content search solution is retired. Content searches are now performed within the context of an eDiscovery case.

Search execution and actions

This integration allows you to manage and interact with Microsoft Security & Compliance Center’s content search capabilities. You can perform comprehensive searches across your organization’s emails, SharePoint sites, OneDrive accounts, and more. Actions like previewing and deleting emails are supported, making it easier to manage potential security threats.

This integration has been developed and tested with the Security & Compliance Center.

The Security and Compliance PowerShell module relies on legacy eDiscovery. We recommend transitioning to the new eDiscovery implementation, which is built on the Microsoft Graph API Microsoft Graph Security integration.

Key Features

  • Content Search Management: Create, modify, retrieve, list, remove, and trigger content searches within the Security & Compliance Center.
  • Search Actions: Perform actions such as previewing and purging (deleting) emails identified in content searches.

Playbooks

  • O365 - Security and Compliance - Search and Delete: Initiates a compliance search and, if configured, deletes or previews identified emails.
  • O365 - Security and Compliance - Search: Initiates a compliance search to locate emails with attributes matching those of a malicious email.
  • O365 - Security and Compliance - Search Action - Delete: Deletes emails found by the search.
  • O365 - Security and Compliance - Search Action - Preview: Provides a preview of emails identified by the search.

Permissions and Authentication Setup

Overview

This section describes how to configure permissions for the integration, supporting both App-only Authentication and Delegated User Authentication.

App Authentication (App-Only)

To set up the integration and register the application in Azure, you will need to perform the following three primary steps:

  1. App Registration and Permission Configuration: Register a new application in Entra ID and configure necessary permissions.
  2. Authentication Configuration: Enable public client flows and create an app secret.
  3. Role Setup: Assign the required roles for the App Service Principal to function correctly.
    Detailed instructions for each step are provided below.

1. App Registration and Permission Configuration

  1. Navigate to Azure Portal: Go to the Azure Portal and sign in with your administrator account.
  2. Access App Registrations: In the left-hand navigation pane, select Entra ID > App registrations.
  3. Register a New App: Click New registration, provide a name, and register the app.
  4. Add API Permissions:
    • Under Manage, select API permissions > Add a permission.
      • Select APIs my organization uses.
      • Search for “Office 365 Exchange Online”.
      • Select Delegated permissions and search for Exchange.Manage.
      • Check the box and click Add permissions.
    • Again select Add a permission.
      • Select APIs my organization uses.
      • Search for “Microsoft Graph”.
      • Select Delegated permissions and search for eDiscovery.ReadWrite.All.
      • Check the box and click Add permissions.
    • Ensure the permissions are gra

2. Authentication Configuration

  1. Navigate to Authentication Settings: In your app registration, click on Authentication -> Settings.
  2. Enable Public Client Flows:
    • Set Allow public client flows to Enabled.
    • Click Save to apply the changes.

3. Role Setup

  1. In the Azure portal, go to Microsoft Entra roles and administrators.
  2. Locate the Required Role
    • Search for the role Compliance Administrator.
    • Select the role to open its details page.
  3. Add Role Assignment
    • Click Add assignments.
    • Select Members.
    • Search for your new application name.
    • Select the application and confirm the assignment.

Delegated User Authentication

This section describes how to configure delegated authentication using a user account. You may either create a dedicated service account for the integration or use an existing user account (including an administrator account). If an existing user is used, you can skip the user creation step and proceed directly to the MFA and role assignment steps.

1. Create a Dedicated User (Microsoft Entra ID)

Create a new user account to serve as a dedicated service account for the integration.

  • Go to the Azure Portal and sign in with an organization administrator account.
  • Navigate to Entra ID → Users → New user.
  • Create a new user and define:
    • User Principal Name (UPN) – this will be used in the integration configuration
    • Display name
    • Password – store this securely

2. Disable Multi-Factor Authentication (MFA)

For delegated authentication to work, MFA must be disabled for this service account.

  • Go to the Microsoft 365 Admin Center and sign in with an organization administrator account.
  • Navigate to Users → Active users.
  • At the top menu, select Multi-factor authentication.
  • Locate the user and verify that the MFA status is set to Disabled.

3. Purview Role Assignment (Microsoft Purview Portal)

Grant the service account the required permissions to run Security & Compliance PowerShell cmdlets.

  • Sign in to the Microsoft Purview Portal using an organization administrator account.
  • Under Setting, navigate to Roles & scopes → Role groups.
  • Locate the built-in eDiscovery Manager role group.
  • Select Copy to create a new custom role group.
  • Provide a name and description.
  • In the Roles section, add the Search and Purge role to the custom role group.
  • In the Users section, add your user.
  • Review the configuration and complete the setup.

Note: Role assignment propagation may take up to one hour.

Known Endpoints

Environment ConnectionUri AzureADAuthorizationEndpointUri
Microsoft 365 or Microsoft 365 GCC https://ps.compliance.protection.outlook.com/powershell-liveid/ https://login.microsoftonline.com
Microsoft 365 GCC High https://ps.compliance.protection.office365.us/powershell-liveid/ https://login.microsoftonline.us
Microsoft 365 DoD https://l5.ps.compliance.protection.office365.us/powershell-liveid/ https://login.microsoftonline.us
Office 365 operated by 21Vianet https://ps.compliance.protection.partner.outlook.cn/powershell-liveid https://login.chinacloudapi.cn

More information available here.

Configure SecurityAndComplianceV2 in Cortex

  1. Navigate to one of the following:
    • Cortex XSOAR 6: Settings > Integrations
    • Cortex XSOAR 8: Settings & Info > Settings > Integrations > Instances
    • Cortex XSIAM: Settings > Configurations > Automation & Feed Integrations
  2. Search for O365 - Security And Compliance - Content Search v2.
  3. Authentication / Authorization methods:
    • App-only (OAuth2.0) using device code Authentication -
      1. Fill in the UPN, App ID, and Tenant ID parameters in the integration configuration.
      2. Run the o365-sc-auth-start command and follow the instructions.
      3. For testing completion of authorization process run the o365-sc-auth-test command.
    • Delegated User Authentication -
      1. Fill in the UPN parameter in the integration configuration.
      2. Fill in the ‘UPN Password’ parameter - the user’s Microsoft 365 password (the regular sign-in password for that UPN).
      3. For testing completion of authorization process run the o365-sc-auth-test command.
      4. The following commands are only available when using the Delegated User Authentication method, as per the Microsoft Update:
        • o365-sc-new-search-action
        • o365-sc-case-hold-policy-create
        • o365-sc-case-hold-policy-set
        • o365-sc-case-hold-policy-delete
        • o365-sc-case-hold-rule-create
        • o365-sc-case-hold-rule-delete
    • Note - If a UPN Password is provided:
      • Even if the password is incorrect, the integration will attempt to authenticate using it.
      • In this case, all connections to Microsoft Security and Compliance PowerShell will use interactive delegated authentication.

  4. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    UPN/Email The email address (UPN) of the user account for the integration. True
    UPN Password Password for the specified UPN. Required when using interactive delegated authentication. False
    App ID The application (client) ID from Azure False
    Tenant ID The directory (tenant) ID from Azure. False
    Organization The organization name for the Security & Compliance Center. False
    Insecure Trust any certificate (not secure). False

  • Expected Output:

    Security and Compliance - Authorize Instructions App-only (OAuth2.0) using device code Authentication

    1. To sign in, open https://microsoft.com/devicelogin in a web browser and enter the code XXXXXXX to authenticate.
    2. Run the !o365-sc-auth-complete command in the War Room.
    3. Test OAuth2.0 authorization by running the !o365-sc-auth-test command.

    Security and Compliance - Authorize Instructions Delegated User Authentication

    1. Test ok!

Troubleshooting and Testing

Common Issues and Solutions

Response status code does not indicate success: 404 Not Found

Scenario: When running the !o365-sc-auth-start command, you may encounter the error message: “Response status code does not indicate success: 404 Not Found.”

Solution:
Verify Required Parameters: Ensure that all required parameters for App-only (using device code) Authentication in the integration instance configuration are correctly filled out. This includes:

  • UPN/Email: The email address (UPN) of the user account for the integration.
  • App ID: The application (client) ID from Azure.
  • Tenant ID: The directory (tenant) ID from Azure.
  • Organization: The organization name for the Security & Compliance Center.

Missing or incorrect values in these fields can cause a 404 error, as the integration might be attempting to connect to an incorrect or non-existent endpoint.

Additional Steps:

  • Check the ConnectionUri: Verify that the ConnectionUri in your configuration matches the environment you are operating in (e.g., Microsoft 365, GCC High, DoD, etc.).
  • Review Endpoint Configuration: Ensure that the AzureADAuthorizationEndpointUri is correctly set according to your environment.

Response status code does not indicate success: 400 Bad Request

Scenario: When running the !o365-sc-auth-start command, you may encounter the error message: “Response status code does not indicate success: 400 Bad Request.”

Solution:
Check Parameters for Accuracy: A 400 Bad Request error often indicates that there is a problem with the request sent to the server. Double-check the following:

  • App ID and Tenant ID: Ensure these are correctly copied from your Azure app registration.
  • UPN/Email: Ensure that the email address is correctly formatted and belongs to a user with the necessary permissions.

Additional Steps:
Test with a Different Account: If possible, try using a different user account to verify if the issue is related to specific user permissions.

Failed OAuth2.0 Authorization

Scenario: After running the !o365-sc-auth-start command, the authorization process fails, and the integration cannot authenticate with the Security & Compliance Center.

Solution:

  • Double-Check App Permissions: Make sure that the app registration in Azure has the necessary permissions, specifically Exchange.ManageAsApp.
  • Grant Admin Consent: Ensure that admin consent has been granted for the required permissions. Without this, the application cannot function correctly.
  • Review Authentication Setup: Ensure that “Allow public client flows” is enabled in the Azure app registration settings under Authentication.

Additional Steps:

  • Use the !o365-sc-auth-test Command: Run this command to verify if the integration can successfully authenticate. If this test fails, revisit the app registration settings and verify all configurations.

Failed Delegated User Authentication

Scenario: You Filled out the ‘UPN’ and ‘UPN Password’ integration parameters and after running the !o365-sc-auth-test command, the authorization process fails, and you get the error ‘you must use multi-factor authentication to access …’.

Solution:

  • Double-Check you disabled MFA:
    1. Go to the Microsoft 365 Admin Center and sign in with your administrator account.
    2. Under Users, select Active users.
    3. At the top, click Multi-factor authentication.
    4. In the list that appears, find your user and check the Multi-Factor Auth Status column is disabled.

Additional Steps:

  • Use the !o365-sc-auth-test Command: Run this command to verify if the integration can successfully authenticate. If this test fails, revisit the app registration settings and verify all configurations.

Testing the Integration

  1. Test Basic Connectivity:
    Use the !o365-sc-auth-test command to confirm that the integration can successfully authenticate with the Security & Compliance Center.

  2. Run a Simple Search:
    Execute the !o365-sc-search command with basic parameters to ensure the integration can perform a search operation. This helps verify that the configuration is correct and the integration can communicate with the Security & Compliance Center.

  3. Check Logs and Outputs:
    After running test commands, review the logs and command outputs in the War Room for any errors or warnings. This can provide additional insights into what might be going wrong.

  4. Review Azure Logs:
    If issues persist, review the logs in Azure to identify any access issues or authentication errors. This can help diagnose problems related to Azure AD configuration.

Additional Resources

Commands

You can execute these commands from the Cortex XSIAM/XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

o365-sc-auth-start

OAuth2.0 - Start authorization.

Base Command

o365-sc-auth-start

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

>## Security And Compliance - Authorize instructions
>
>1. To sign in, use a web browser to open the page [https://microsoft.com/devicelogin](https://microsoft.com/devicelogin) and enter the code **XXXXXXX** to authenticate.
>2. Run the ***!o365-sc-auth-complete*** command in the War Room.

### o365-sc-auth-complete

***
OAuth2.0 - Complete authorization.

#### Base Command

`o365-sc-auth-complete`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!o365-sc-auth-complete```

#### Human Readable Output

>Your account **successfully** authorized!

### o365-sc-auth-test

***
OAuth2.0 - Test authorization.

#### Base Command

`o365-sc-auth-test`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!o365-sc-auth-test```

#### Human Readable Output

>**Test ok!**

### o365-sc-new-search

***
Create compliance search in the Security & Compliance Center.

#### Base Command

`o365-sc-new-search`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| search_name | The name of the compliance search. If not specified, will have the prefix "XSOAR-" followed by the GUID e.g., XSOAR-d6228fd0-756b-4e4b-8721-76776df91526. | Required |
| case | The name of a Core eDiscovery case to associate with the new compliance search. | Optional |
| kql | Text search string or a query that is formatted using the Keyword Query Language (KQL). [Tips for finding messages to remove using KQL](#tips-for-finding-messages-to-remove)
| Optional |
| description | Description of the compliance search. | Optional |
| allow_not_found_exchange_locations | Whether to include mailboxes other than regular user mailboxes in the compliance search. Default is "false". | Optional |
| exchange_location | Comma-separated list of mailboxes/distribution groups to include, or you can use the value "All" to include all. | Optional |
| exchange_location_exclusion | Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter. Deprecated since Microsoft is supporting it only on-premise. | Optional |
| public_folder_location | Comma-separated list of public folders to include, or you can use the value "All" to include all. | Optional |
| share_point_location | Comma-separated list of SharePoint online sites to include. You can identify the sites by their URL value, or you can use the value "All" to include all sites. | Optional |
| share_point_location_exclusion | Comma-separated list of SharePoint online sites to exclude when you use the value "All" for the share_point_location argument. You can identify the sites by their URL value. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled | Boolean | Whether to include mailboxes other than regular user mailboxes in the compliance search. |
| O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled | Boolean | Whether the Azure Batch Framework is enabled for job processing. |
| O365.SecurityAndCompliance.ContentSearch.Search.CaseId | String | Identity of a Core eDiscovery case which is associated with the compliance search. |
| O365.SecurityAndCompliance.ContentSearch.Search.CaseName | String | Name of a Core eDiscovery case which is associated with the compliance search. |
| O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery | String | Compliance text search string or a query that is formatted using the Keyword Query Language \(KQL\). |
| O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy | String | Security and compliance search creator. |
| O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime | Date | Security and compliance search creation time. |
| O365.SecurityAndCompliance.ContentSearch.Search.Description | String | Security and compliance search description. |
| O365.SecurityAndCompliance.ContentSearch.Search.Errors | String | Security and compliance search errors. |
| O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation | String | Security and compliance search exchange locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.Identity | String | Security and compliance search identity. |
| O365.SecurityAndCompliance.ContentSearch.Search.IsValid | Boolean | Whether the security and compliance search is valid. |
| O365.SecurityAndCompliance.ContentSearch.Search.Items | Number | The number of security and compliance search scanned items. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime | Date | Security and compliance search job end time. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobId | String | Security and compliance search job ID. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobRunId | String | Security and compliance search job run ID. |
| O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime | Date | Security and compliance search job run start time. |
| O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime | Date | Security and compliance search last modification time. |
| O365.SecurityAndCompliance.ContentSearch.Search.LogLevel | String | Security and compliance search Azure log level. |
| O365.SecurityAndCompliance.ContentSearch.Search.Name | String | Security and compliance search name. |
| O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation | String | Security and compliance search OneDrive locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion | String | Security and compliance search OneDrive locations to exclude. |
| O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation | String | Security and compliance search public folder locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion | String | Security and compliance search public folder locations to exclude. |
| O365.SecurityAndCompliance.ContentSearch.Search.RunBy | String | Security and compliance search last run by UPN \(Email representation\). |
| O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId | String | Security and compliance search run space ID. |
| O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation | String | Security and compliance search SharePoint locations to include. |
| O365.SecurityAndCompliance.ContentSearch.Search.Size | Number | Security and compliance search bytes results size. |
| O365.SecurityAndCompliance.ContentSearch.Search.Status | String | Security and compliance search status. |
| O365.SecurityAndCompliance.ContentSearch.Search.TenantId | String | Security and compliance search Tenant ID. |

#### Command Example

```!o365-sc-new-search search_name="example" exchange_location="user1@demistodev.onmicrosoft.com,user2@demistodev.onmicrosoft.com" allow_not_found_exchange_locations=true kql="Rodrigo"```

#### Context Example

```json
{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "Search": {
                    "AllowNotFoundExchangeLocationsEnabled": true,
                    "AzureBatchFrameworkEnabled": false,
                    "CaseId": null,
                    "CaseName": "",
                    "ContentMatchQuery": "Rodrigo",
                    "CreatedBy": "XSOAR-user",
                    "CreatedTime": "2020-11-29T07:12:46.5943533Z",
                    "Description": "Short description",
                    "Errors": null,
                    "ExchangeLocation": [
                        "test1@onmicrosoft.com",
                        "test2@onmicrosoft.com"
                    ],
                    "ExchangeLocationExclusion": [],
                    "Identity": "xxxxx",
                    "IsValid": true,
                    "Items": 0,
                    "JobEndTime": null,
                    "JobId": "xxxxx",
                    "JobRunId": null,
                    "JobStartTime": null,
                    "LastModifiedTime": "2020-11-29T07:12:46.5943533Z",
                    "LogLevel": "Suppressed",
                    "Name": "example",
                    "OneDriveLocation": null,
                    "OneDriveLocationExclusion": null,
                    "PublicFolderLocation": null,
                    "PublicFolderLocationExclusion": null,
                    "RunBy": "",
                    "RunspaceId": null,
                    "SharePointLocation": null,
                    "SharePointLocationExclusion": null,
                    "Size": 0,
                    "Status": "NotStarted",
                    "SuccessResults": null,
                    "TenantId": "xxxxx"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - New search ‘example’ created

ContentMatchQuery CreatedBy Description LastModifiedTime Name
Rodrigo XSOAR-user Short description 11/29/2020 7:12:46 AM example

o365-sc-set-search

Modifies non-running compliance searches in the Security & Compliance Center.

Base Command

o365-sc-set-search

Input

Argument Name Description Required
search_name The name of the compliance search. Required
kql Modify the text search string or a query that is formatted using the Keyword Query Language (KQL). Optional
description Modify the description for the compliance search. Optional
allow_not_found_exchange_locations Whether to include mailboxes other than regular user mailboxes in the compliance search. Optional
add_exchange_location Comma-separated list of added mailboxes/distribution groups to include, or you can use the value “All” to include all mailboxes. Optional
add_exchange_location_exclusion Comma-separated list of added mailboxes/distribution groups to exclude when you use the value “All” for the exchange_location (used in create new compliance search) or the add_exchange_location argument. Optional
add_public_folder_location Comma-separated list of added public folders to include, or you can use the value “All” to include all. Optional
add_share_point_location Comma-separated list of added SharePoint online sites to include. You identify the sites by their URL value, or you can use the value “All” to include all sites. Optional
add_share_point_location_exclusion Comma-separated list of added SharePoint online sites to exclude when you use the value “All” for the exchange_location (used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value. Optional
remove_exchange_location Comma-separated list of removed mailboxes/distribution group to include. Optional
remove_exchange_location_exclusion Comma-separated list of removed mailboxes/distribution group to exclude when you use the value “All” for the exchange_location (Used in create new compliance search) or the add_exchange_location argument. Optional
remove_public_folder_location Comma-separated list of removed public folders to include. Optional
remove_share_point_location Comma-separated list of removed SharePoint online sites to include. You can identify the sites by their URL value. Optional
remove_share_point_location_exclusion Comma-separated list of removed SharePoint online sites to exclude when you use the value “All” for the exchange_location (Used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value. Optional

Context Output

There is no context output for this command.

Command Example

!o365-sc-set-search search_name="example" remove_exchange_location="test2@demistodev.onmicrosoft.com"

Human Readable Output

Security And Compliance - Search example modified!

o365-sc-remove-search

Remove compliance search by name from the Security & Compliance Center.

Base Command

o365-sc-remove-search

Input

Argument Name Description Required
search_name The name of the compliance search. Required

Context Output

There is no context output for this command.

Command Example

!o365-sc-remove-search search_name="example"

Human Readable Output

Security And Compliance - Search example removed!

o365-sc-list-search

List compliance searches in the Security & Compliance Center.

Base Command

o365-sc-list-search

Input

There are no input arguments for this command.

Context Output

Path Type Description
O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled Boolean Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled Boolean Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.Search.CaseId String Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.CaseName String Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery String Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy String Security and compliance search creator.
O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime Date Security and compliance search creation time.
O365.SecurityAndCompliance.ContentSearch.Search.Description String Security and compliance search description.
O365.SecurityAndCompliance.ContentSearch.Search.Errors String Security and compliance search errors.
O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation String Security and compliance search exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Identity String Security and compliance search identity.
O365.SecurityAndCompliance.ContentSearch.Search.IsValid Boolean Whether the security and compliance search is valid.
O365.SecurityAndCompliance.ContentSearch.Search.Items Number The number of security and compliance search scanned items.
O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime Date Security and compliance search job end time.
O365.SecurityAndCompliance.ContentSearch.Search.JobId String Security and compliance search job ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobRunId String Security and compliance search job run ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime Date Security and compliance search job run start time.
O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime Date Security and compliance search last modification time.
O365.SecurityAndCompliance.ContentSearch.Search.LogLevel String Security and compliance search Azure log level.
O365.SecurityAndCompliance.ContentSearch.Search.Name String Security and compliance search name.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation String Security and compliance search OneDrive locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion String Security and compliance search OneDrive locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation String Security and compliance search public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion String Security and compliance search public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.RunBy String Security and compliance search last run by UPN (Email representation).
O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId String Security and compliance search run space ID.
O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation String Security and compliance search SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Size Number Security and compliance search bytes results size.
O365.SecurityAndCompliance.ContentSearch.Search.Status String Security and compliance search status.
O365.SecurityAndCompliance.ContentSearch.Search.TenantId String Security and compliance search Tenant ID.

Command Example


#### Context Example

```json
{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "Search": [
                    {
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "ContentMatchQuery": "subject:test",
                        "CreatedBy": "XSOAR-user1",
                        "CreatedTime": "2019-08-22T06:43:48.747",
                        "Description": "Short description",
                        "Errors": null,
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "Items": 0,
                        "JobEndTime": "2019-09-05T13:21:11.563",
                        "JobId": "xxxx",
                        "JobRunId": null,
                        "JobStartTime": "2019-09-05T13:20:34.633",
                        "LastModifiedTime": "2019-08-22T06:43:48.747",
                        "LogLevel": "Suppressed",
                        "Name": "example1",
                        "OneDriveLocation": null,
                        "OneDriveLocationExclusion": null,
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "RunBy": "XSOAR-user1",
                        "RunspaceId": null,
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Size": 0,
                        "Status": "Completed",
                        "SuccessResults": null,
                        "TenantId": "xxxx"
                    },
                    {
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "ContentMatchQuery": "subject:Incident Summary Report",
                        "CreatedBy": "XSOAR-user2",
                        "CreatedTime": "2020-01-08T00:44:30.94",
                        "Description": "Short description",
                        "Errors": null,
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "Items": 0,
                        "JobEndTime": "2020-01-08T00:45:13.433",
                        "JobId": "xxxxx",
                        "JobRunId": null,
                        "JobStartTime": "2020-01-08T00:44:33.717",
                        "LastModifiedTime": "2020-01-08T00:44:30.94",
                        "LogLevel": "Suppressed",
                        "Name": "example2",
                        "OneDriveLocation": null,
                        "OneDriveLocationExclusion": null,
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "RunBy": "XSOAR-user2",
                        "RunspaceId": null,
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Size": 0,
                        "Status": "Completed",
                        "SuccessResults": null,
                        "TenantId": "xxxxx"
                    }
                ]
            }
        }
    }
}

Human Readable Output

Security And Compliance - Search configurations

CreatedBy Description LastModifiedTime Name RunBy
XSOAR-user1 Short description 8/22/2019 6:43:48 AM example1 XSOAR-user1
XSOAR-user2 Short description 1/8/2020 12:44:30 AM example2 XSOAR-user2

o365-sc-get-search

Gets compliance search by name from the Security & Compliance Center.

Base Command

o365-sc-get-search

Input

Argument Name Description Required
search_name The name of the compliance search. Required
limit The maximum number of results to return. If you want to return all requests that match the query, use “-1” for the value of this argument. Optional
all_results Whether to include mailboxes which have no results in results entry context. Optional
export Whether to export search results as json file to war-room. Optional
statistics Show search statistics. Default is “false”. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled Boolean Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled Boolean Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.Search.CaseId String Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.CaseName String Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery String Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy String Security and compliance search creator.
O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime Date Security and compliance search creation time.
O365.SecurityAndCompliance.ContentSearch.Search.Description String Security and compliance search description.
O365.SecurityAndCompliance.ContentSearch.Search.Errors String Security and compliance search errors.
O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation String Security and compliance search exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Identity String Security and compliance search identity.
O365.SecurityAndCompliance.ContentSearch.Search.IsValid Boolean Whether the security and compliance search is valid.
O365.SecurityAndCompliance.ContentSearch.Search.Items Number Number of security and compliance search scanned items.
O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime Date Security and compliance search job end time.
O365.SecurityAndCompliance.ContentSearch.Search.JobId String Security and compliance search job ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobRunId String Security and compliance search job run ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime Date Security and compliance search job run start time.
O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime Date Security and compliance search last modification time.
O365.SecurityAndCompliance.ContentSearch.Search.LogLevel String Security and compliance search the Azure log level.
O365.SecurityAndCompliance.ContentSearch.Search.Name String Security and compliance search name.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation String Security and compliance search OneDrive locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion String Security and compliance search OneDrive locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation String Security and compliance search public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion String Security and compliance search public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.RunBy String Security and compliance search last run by UPN (Email representation).
O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId String Security and compliance search run space ID.
O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation String Security and compliance search SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Size Number Security and compliance search bytes results size.
O365.SecurityAndCompliance.ContentSearch.Search.Status String Security and compliance search status.
O365.SecurityAndCompliance.ContentSearch.Search.TenantId String Security and compliance search Tenant ID.
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Location String Security and compliance search result location.
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.ItemsCount Number The number of security and compliance search results in location.
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Size Number The byte size of the security and compliance search results in location.

Command Example

!o365-sc-get-search search_name="example"

Context Example

{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "Search": {
                    "Errors": "", 
                    "AzureBatchFrameworkEnabled": false,
                    "TenantId": "xxxxx", 
                    "SharePointLocationExclusion": null, 
                    "JobStartTime": "2020-11-29T07:20:59.37", 
                    "CreatedTime": "2020-11-29T07:18:04.283", 
                    "OneDriveLocation": null, 
                    "PublicFolderLocation": null, 
                    "Status": "Completed", 
                    "CaseName": "", 
                    "AllowNotFoundExchangeLocationsEnabled": false, 
                    "LogLevel": "Suppressed", 
                    "JobRunId": null, 
                    "CaseId": null, 
                    "JobId": "xxxxx", 
                    "SuccessResults": {
                        "ItemsCount": "122303", 
                        "Location": "user@onmicrosoft.com", 
                        "Size": "12339007379"
                    }, 
                    "LastModifiedTime": "2020-11-29T07:20:43.283", 
                    "Identity": "1d130723-fe0a-4726-6d2a-08d89437520e", 
                    "Name": "example", 
                    "Items": 122303, 
                    "ExchangeLocation": [
                        "user@onmicrosoft.com"
                    ], 
                    "RunBy": "XSOAR-user", 
                    "Description": "Short description", 
                    "ExchangeLocationExclusion": [], 
                    "IsValid": true, 
                    "PublicFolderLocationExclusion": null, 
                    "SharePointLocation": null, 
                    "CreatedBy": "XSOAR-user", 
                    "JobEndTime": "2020-11-29T07:22:01.99", 
                    "RunspaceId": null, 
                    "Size": 12339007379, 
                    "OneDriveLocationExclusion": null, 
                    "ContentMatchQuery": "Rodrigo"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - ‘example’ search

CreatedBy Description LastModifiedTime Name RunBy Status
XSOAR-user Short description 2020-11-29T07:20:43.283 example XSOAR-user NotStarted

o365-sc-start-search

Starts stopped, completed, or not started compliance search in the Security & Compliance Center.

Base Command

o365-sc-start-search

Input

Argument Name Description Required
search_name The name of the compliance search. Required

Context Output

There is no context output for this command.

Command Example

!o365-sc-start-search search_name="example"

Human Readable Output

Security And Compliance - search example started !

o365-sc-stop-search

Stop running compliance search in the Security & Compliance Center.

Base Command

o365-sc-stop-search

Input

Argument Name Description Required
search_name The name of the compliance search. Required

Context Output

There is no context output for this command.

Command Example

!o365-sc-stop-search search_name="example"

Human Readable Output

Security And Compliance - search example stopped !

o365-sc-new-search-action

After you create a content search using the o365-sc-new-search command and run it using the o365-sc-start-search command, you assign a search action to the search using the o365-sc-new-search-action command.

Please note that when performing the Delete action, items which are deleted will still follow your EWS365 data retention policies. Some data retention policies will move emails to the “Purges” or “Recoverable Items” folder.

Base Command

o365-sc-new-search-action

Input

Argument Name Description Required
search_name The name of the compliance search. Required
action Search action to perform. Possible values are: Preview, Purge. Default is Preview. Optional
purge_type Purge type. Possible values are: SoftDelete, HardDelete. Default is SoftDelete. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.ContentSearch.SearchAction.Action String Security and compliance search action type. Either “Purge” or “Preview”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled Boolean Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled Boolean Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId String Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName String Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy String Security and compliance search action creator.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime Date Security and compliance search action creation time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Description String Security and compliance search action description.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors String Security and compliance search action errors.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId String Security and compliance search action job ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId String Security and compliance search action run ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation String Security and compliance search action exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion String Security and compliance search action exchange locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity String Security and compliance search action identity.
O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid Boolean Whether the security and compliance search action is valid.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime Date Security and compliance search action job end time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId String Security and compliance search action job ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId String Security and compliance search action job run ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime Date Security and compliance search action job start time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime Date Security and compliance search action last modified time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Name String Security and compliance search action name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation String Security and compliance search action public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion String Security and compliance search action public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry Boolean Whether to retry if the search action failed.
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy String Security and compliance search action run by UPN (email address).
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId String Security and compliance search action run space ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName String Security and compliance search action search name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation String Security and compliance search action SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion String Security and compliance search action SharePoint locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Status String Security and compliance search action status. Either “Started” or “Completed”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId String Security and compliance search action Tenant ID.

Command Example

!o365-sc-new-search-action search_name="example" action="Preview"

Context Example

{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "SearchAction": {
                    "Action": "Preview",
                    "AllowNotFoundExchangeLocationsEnabled": false,
                    "AzureBatchFrameworkEnabled": false,
                    "CaseId": null,
                    "CaseName": "",
                    "CreatedBy": "XSOAR-user",
                    "CreatedTime": "2020-11-29T07:23:50.05",
                    "Description": "",
                    "Errors": "",
                    "EstimateSearchJobId": "xxxxx",
                    "EstimateSearchRunId": "xxxxx",
                    "ExchangeLocation": [
                        "user@onmicrosoft.com"
                    ],
                    "ExchangeLocationExclusion": null,
                    "Identity": "xxxxx",
                    "IsValid": true,
                    "JobEndTime": "2020-11-29T07:24:05.76",
                    "JobId": "xxxxx",
                    "JobRunId": "xxxxx",
                    "JobStartTime": "2020-11-29T07:23:50.297",
                    "LastModifiedTime": "2020-11-29T07:23:50.05",
                    "Name": "example_Preview",
                    "PublicFolderLocation": null,
                    "PublicFolderLocationExclusion": null,
                    "Results": null,
                    "Retry": false,
                    "RunBy": "XSOAR-user",
                    "RunspaceId": "xxxxx",
                    "SearchName": "example",
                    "SharePointLocation": null,
                    "SharePointLocationExclusion": null,
                    "Status": "Completed",
                    "TenantId": "xxxxx"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - search action ‘example_Preview’ created

Action LastModifiedTime Name RunBy SearchName Status
Preview 11/29/2020 7:23:50 AM example_Preview XSOAR-user example Completed

o365-sc-remove-search-action

Removes compliance search action by search the action name from the Security & Compliance Center.

Base Command

o365-sc-remove-search-action

Input

Argument Name Description Required
search_action_name The name of the compliance search action. Required

Context Output

There is no context output for this command.

Command Example

!o365-sc-remove-search-action search_action_name="example_Preview"

Human Readable Output

Security And Compliance - search action example_Preview removed!

o365-sc-list-search-action

Lists compliance search actions from the Security & Compliance Center.

Base Command

o365-sc-list-search-action

Input

There are no input arguments for this command.

Context Output

Path Type Description
O365.SecurityAndCompliance.ContentSearch.SearchAction.Action String Security and compliance search action type. Either “Purge or “Preview”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled Boolean Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled Boolean Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId String Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName String Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy String Security and compliance search action creator.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime Date Security and compliance search action creation time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Description String Security and compliance search action description.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors String Security and compliance search action errors.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId String Security and compliance search action job ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId String Security and compliance search action run ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation String Security and compliance search action exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion String Security and compliance search action exchange locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity String Security and compliance search action identity.
O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid Boolean Whether the security and compliance search action is valid.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime Date Security and compliance search action job end time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId String Security and compliance search action job ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId String Security and compliance search action job run ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime Date Security and compliance search action job start time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime Date Security and compliance search action last modified time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Name String Security and compliance search action name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation String Security and compliance search action public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion String Security and compliance search action public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry Boolean Whether to retry if the search action failed.
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy String Security and compliance search action run by UPN (email address).
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId String Security and compliance search action run space ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName String Security and compliance search action search name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation String Security and compliance search action SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion String Security and compliance search action SharePoint locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Status String Security and compliance search action status (Started/Completed).
O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId String Security and compliance search action Tenant ID.

Command Example


#### Context Example

```json
{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "SearchAction": [
                    {
                        "Action": "Preview",
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "CreatedBy": "XSOAR-user",
                        "CreatedTime": "2020-10-14T13:45:44.14",
                        "Description": "",
                        "Errors": "",
                        "EstimateSearchJobId": "xxxxx",
                        "EstimateSearchRunId": "xxxxx",
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "JobEndTime": "2020-10-14T13:47:00.103",
                        "JobId": "xxxxx",
                        "JobRunId": "xxxxx",
                        "JobStartTime": "2020-10-14T13:45:58.443",
                        "LastModifiedTime": "2020-10-14T13:45:44.14",
                        "Name": "example_Preview",
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "Results": null,
                        "Retry": false,
                        "RunBy": "XSOAR-user",
                        "RunspaceId": "xxxxx",
                        "SearchName": "example",
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Status": "Completed",
                        "TenantId": "xxxxx"
                    },
                   {
                        "Action": "Purge",
                        "AllowNotFoundExchangeLocationsEnabled": false,
                        "AzureBatchFrameworkEnabled": false,
                        "CaseId": null,
                        "CaseName": "",
                        "CreatedBy": "XSOAR-user1",
                        "CreatedTime": "2020-10-14T13:45:44.14",
                        "Description": "",
                        "Errors": "",
                        "EstimateSearchJobId": "xxxxx",
                        "EstimateSearchRunId": "xxxxx",
                        "ExchangeLocation": null,
                        "ExchangeLocationExclusion": null,
                        "Identity": "xxxxx",
                        "IsValid": true,
                        "JobEndTime": "2020-10-14T13:47:00.103",
                        "JobId": "xxxxx",
                        "JobRunId": "xxxxx",
                        "JobStartTime": "2020-10-14T13:45:58.443",
                        "LastModifiedTime": "2020-10-14T13:45:44.14",
                        "Name": "example_Purge",
                        "PublicFolderLocation": null,
                        "PublicFolderLocationExclusion": null,
                        "Results": null,
                        "Retry": false,
                        "RunBy": "XSOAR-user1",
                        "RunspaceId": "xxxxx",
                        "SearchName": "Rodrigo-diffrent",
                        "SharePointLocation": null,
                        "SharePointLocationExclusion": null,
                        "Status": "Completed",
                        "TenantId": "xxxxx"
                    }
                ]
            }
        }
    }
}

Human Readable Output

Security And Compliance - search actions

Action JobEndTime LastModifiedTime Name RunBy SearchName Status
Preview 10/14/2020 1:47:00 PM 10/14/2020 1:45:44 PM example_Preview XSOAR-user example Completed
Purge 11/25/2020 10:51:04 AM 11/25/2020 10:50:37 AM example_Purge XSOAR-user example Completed

o365-sc-get-search-action

Gets compliance search action from the Security & Compliance Center.

Base Command

o365-sc-get-search-action

Input

Argument Name Description Required
search_action_name The name of the compliance search action. Required
limit The maximum number of results to return. If you want to return all requests that match the query, use “-1” for the value of this argument. Optional
export Whether to export search results as json file to war-room. Optional
results Whether to print the results in the War Room. Default is “false”. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.ContentSearch.SearchAction.Action String Security and compliance search action type. Either “Purge” or “Preview”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled Boolean Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled Boolean Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId String Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName String Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy String Security and compliance search action creator.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime Date Security and compliance search action creation time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Description String Security and compliance search action description.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors String Security and compliance search action errors.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId String Security and compliance search action job ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId String Security and compliance search action run ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation String Security and compliance search action exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion String Security and compliance search action exchange locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity String Security and compliance search action identity.
O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid Boolean Whether the security and compliance search action is valid.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime Date Security and compliance search action job end time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId String Security and compliance search action job ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId String Security and compliance search action job run ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime Date Security and compliance search action job start time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime Date Security and compliance search action last modified time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Name String Security and compliance search action name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation String Security and compliance search action public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion String Security and compliance search action public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Location String Security and compliance search action result location.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ItemCount String Security and compliance search action result item count.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.TotalSize String Security and compliance search action result total size.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.FailedCount String Security and compliance search action result failed count.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Sender String Security and compliance search action result mail sender.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Subject String Security and compliance search action result subject.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Type String Security and compliance search action result type.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Size String Security and compliance search action result size.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ReceivedTime Date Security and compliance search action result received time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.DataLink String Security and compliance search action data link.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry Boolean Whether to retry if the search action failed.
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy String Security and compliance search action run by UPN (email address).
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId String Security and compliance search action run space ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName String Security and compliance search action search name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation String Security and compliance search action SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion String Security and compliance search action SharePoint locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Status String Security and compliance search action status. Either “Started” or “Completed”.
O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId String Security and compliance search action Tenant ID.

Command Example

!o365-sc-get-search-action search_action_name="example_Preview"

Context Example

{
    "O365": {
        "SecurityAndCompliance": {
            "ContentSearch": {
                "SearchAction": {
                    "Action": "Preview",
                    "AllowNotFoundExchangeLocationsEnabled": false,
                    "AzureBatchFrameworkEnabled": false,
                    "CaseId": null,
                    "CaseName": "",
                    "CreatedBy": "XSOAR-user",
                    "CreatedTime": "2020-11-29T07:23:50.05",
                    "Description": "",
                    "Errors": "",
                    "EstimateSearchJobId": "2a967c40-07c3-4903-ed7f-08d89436e9b1",
                    "EstimateSearchRunId": "1d130723-fe0a-4726-6d2a-08d89437520e",
                    "ExchangeLocation": [
                        "user@onmicrosoft.com"
                    ],
                    "ExchangeLocationExclusion": null,
                    "Identity": "xxxxx",
                    "IsValid": true,
                    "JobEndTime": "2020-11-29T07:24:05.76",
                    "JobId": "xxxxx",
                    "JobRunId": "xxxxx",
                    "JobStartTime": "2020-11-29T07:23:50.297",
                    "LastModifiedTime": "2020-11-29T07:23:50.05",
                    "Name": "example_Preview",
                    "PublicFolderLocation": null,
                    "PublicFolderLocationExclusion": null,
                    "Results": [
                        {
                            "DataLink": "data/All/xxxx.eml",
                            "Location": "user@onmicrosoft.com",
                            "ReceivedTime": "11/26/2020 2:59:01 PM",
                            "Sender": "Some user",
                            "Size": "19683",
                            "Subject": "Test1",
                            "Type": "Email"
                        },
                       {
                            "DataLink": "data/All/xxxx.eml",
                            "Location": "user@onmicrosoft.com",
                            "ReceivedTime": "12/26/2020 2:59:01 PM",
                            "Sender": "Some user",
                            "Size": "20225",
                            "Subject": "Test2",
                            "Type": "Email"
                        },
                    ],
                    "Retry": false,
                    "RunBy": "XSOAR-user",
                    "RunspaceId": "xxxxx",
                    "SearchName": "example",
                    "SharePointLocation": null,
                    "SharePointLocationExclusion": null,
                    "Status": "Completed",
                    "TenantId": "xxxxx"
                }
            }
        }
    }
}

Human Readable Output

Security And Compliance - search action ‘example_Preview’

Action JobEndTime LastModifiedTime Name RunBy SearchName Status
Preview 11/29/2020 7:24:05 AM 11/29/2020 7:23:50 AM example_Preview XSOAR-user example Completed

Tips for finding messages to remove

  • Keyword Query Language (KQL)
    • If you know the exact text or phrase used in the subject line of the message, use the Subject property in the search query, e.g., (subject:give me all ur money).
    • If you know that exact date (or date range) of the message, include the Received property in the search query, e.g., (received:6/13/2021..6/16/2021).
    • If you know who sent the message, include the From property in the search query, e.g., (from:user1@demistodev.onmicrosoft.com).
    • For all the available search properties see: Keyword queries and search conditions for eDiscovery.
  • Preview the search results to verify that the search returned only the message (or messages) that you want to delete.
  • Use the search estimate statistics (displayed by using the o365-sc-get-search command) to get a count of the total number of emails.

o365-sc-compliance-case-create

Create eDiscovery cases in the Microsoft Purview compliance portal.

Base Command

o365-sc-compliance-case-create

Input

Argument Name Description Required
case_name Case name create. Required
case_type “AdvancedEdiscovery: Used to manage legal or other types of investigations.
ComplianceClassifier: This type of case corresponds to a trainable classifier.
DataInvestigation: Data investigation cases are used to investigate data spillage incidents.
DSR: Data Subject Request (DSR) cases are used to manage General Data Protection Regulation (GDPR) DSR investigations.
eDiscovery: eDiscovery (also called eDiscovery Standard) cases are used to manage legal or other types of investigations.
This is the default value.
InsiderRisk: Insider risk cases are used to manage insider risk management cases.
Typically, insider risk management cases are manually created in the Microsoft Purview
compliance portal to further investigate activity based on a risk alert.
SupervisionPolicy: This type of case corresponds to communication compliance policy.”
. Possible values are: AdvancedEdiscovery, ComplianceClassifier, DataInvestigation, DSR, eDiscovery, InsiderRisk, SupervisionPolicy. Default is eDiscovery.		 Optional
description Case description. Optional
external_id Case external ID. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.ComplianceCase.Name String Case name.
O365.SecurityAndCompliance.ComplianceCase.Status String Case status.
O365.SecurityAndCompliance.ComplianceCase.CreatedDateTime String Case created date time.

o365-sc-compliance-case-list

List different types of compliance cases in the Microsoft Purview compliance portal.

Base Command

o365-sc-compliance-case-list

Input

Argument Name Description Required
identity List cases by identity. Optional
case_type List cases by type. Possible values are: AdvancedEdiscovery, ComplianceClassifier, DataInvestigation, DSR, eDiscovery, InsiderRisk, SupervisionPolicy. Optional
limit Limit returned cases list size. Default is 50. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.ComplianceCase.Name String Case name.
O365.SecurityAndCompliance.ComplianceCase.Status String Case status.
O365.SecurityAndCompliance.ComplianceCase.GUID UUID Case GUID.
O365.SecurityAndCompliance.ComplianceCase.CreatedDateTime String Case created date time.

o365-sc-compliance-case-delete

Removes compliance cases from the Microsoft Purview compliance portal.

Base Command

o365-sc-compliance-case-delete

Input

Argument Name Description Required
identity Delete case by identity. Required

Context Output

There is no context output for this command.

o365-sc-case-hold-policy-create

Creates new case hold policies in the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-policy-create

Input

Argument Name Description Required
policy_name Name of the policy to create. Required
case eDiscovery case, Case Name, Case Identity (GUID value). Required
comment Attach a comment to the case. Optional
exchange_location Mailbox or distribution group. Optional
public_folder_location Comma-separated list of public folders to include, or you can use the value “All” to include all. Optional
share_point_location SharePoint Online and OneDrive for Business sites to include. Optional
enabled Set hold policy as enabled or not. Possible values are: true, false. Default is true. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.CaseHoldPolicy.Name String Case hold policy name.
O365.SecurityAndCompliance.CaseHoldPolicy.Workload String Case hold policy workload.
O365.SecurityAndCompliance.CaseHoldPolicy.Enabled String Is case hold policy enabled.
O365.SecurityAndCompliance.CaseHoldPolicy.Mode String Case hold policy mode.

o365-sc-case-hold-policy-get

View existing case hold policies in the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-policy-get

Input

Argument Name Description Required
identity Identify of the case hold policy to get. Optional
case Case of policy to get. Case name or case GUID. Optional
distribution_detail Whether to include distribution details or not. Possible values are: true, false. Default is true. Optional
include_bindings Whether to include bindings or not. Possible values are: true, false. Default is true. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.CaseHoldPolicy.Name String Case hold policy name.
O365.SecurityAndCompliance.CaseHoldPolicy.GUID String Case hold policy GUID.
O365.SecurityAndCompliance.CaseHoldPolicy.Workload String Case hold policy workload.
O365.SecurityAndCompliance.CaseHoldPolicy.Status String Case hold policy status.
O365.SecurityAndCompliance.CaseHoldPolicy.Mode String Case hold policy mode.

o365-sc-case-hold-policy-delete

Removes case hold policies from the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-policy-delete

Input

Argument Name Description Required
identity Identify of the case hold policy to delete. Required
force_delete Whether to use force delete or not. Possible values are: true, false. Default is false. Optional

Context Output

There is no context output for this command.

o365-sc-case-hold-rule-create

Creates new case hold rules in the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-rule-create

Input

Argument Name Description Required
rule_name Create rule with the specified name. Required
policy_name Create rule for the specified policy. Required
query Query using Keyword Query Language (KQL). Optional
comment Attach a comment to the created rule. Optional
is_disabled Whether the rule is disabled or not. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.CaseHoldRule.Name String Case hold policy name.
O365.SecurityAndCompliance.CaseHoldRule.Status String Case hold policy status.
O365.SecurityAndCompliance.CaseHoldRule.Mode String Case hold policy mode.

o365-sc-case-hold-rule-list

View case hold rules in the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-rule-list

Input

Argument Name Description Required
identify Get hold rule list by identity. Optional
policy Get hold rule list by policy. Optional
limit Limit the returned items list size. Default is 50. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.CaseHoldRule.Name String Case hold policy name.
O365.SecurityAndCompliance.CaseHoldRule.GUID UUID Case hold policy GUID.
O365.SecurityAndCompliance.CaseHoldRule.Enabled String Whether case hold policy is enabled.
O365.SecurityAndCompliance.CaseHoldRule.Mode String Case hold policy mode.

o365-sc-case-hold-rule-delete

Removes case hold rules from the Microsoft Purview compliance portal.

Base Command

o365-sc-case-hold-rule-delete

Input

Argument Name Description Required
identity Delete rule by identity. Optional
force_delete Whether to use force delete or not. Possible values are: true, false. Default is false. Optional

Context Output

There is no context output for this command.

Known Limitations

  • Security and compliance integrations do not support Security and compliance on-premise.
  • Each security and compliance command creates an IPS-Session (PowerShell session). The security and compliance PowerShell limits the number of concurrent sessions to 3. Since this affects the behavior of multiple playbooks running concurrently it we recommend that you retry failed tasks when using the integration commands in playbooks.
  • Proxies are not supported due to a Microsoft limitation.
  • Due to a Microsoft limitation, you can perform a search and purge operation on a maximum of 50,000 mailboxes. To work around this limitation, configure multiple instances of the integration each with different permission filtering so that the number of mailboxes in each instance does not exceed 50,000.
  • A maximum of 10 items per mailbox can be removed at one time, due to a Microsoft limitiation.
  • For more Microsoft known limitations see Limits for eDiscovery search.

o365-sc-case-hold-policy-set

Update inputs for case hold policies.

Base Command

o365-sc-case-hold-policy-set

Input

Argument Name Description Required
identity Identity of the policy to update. Required
add_exchange_locations Exchange locations to add to the policy. Optional
add_sharepoint_locations Sharepoint locations to add to the policy. Optional
add_public_locations Public locations to add to the policy. Optional
remove_exchange_locations Exchange locations to remove from the policy. Optional
remove_sharepoint_locations Sharepoint locations to remove from the policy. Optional
remove_public_locations Public locations to remove from the policy. Optional
comment Add a comment to existing policy. Optional
enabled Enable or disable the policy. Possible values are: true, false. Default is true. Optional

Context Output

There is no context output for this command.

o365-sc-email-security-search-and-delete-email-office-365-quick-action

Deletes an email for all recipients.
On first run, creates and starts a search (if it already exists – returns its status).
Then runs polling until the deletion is complete.
The force parameter allows creating a new search even if one already exists (default: false).

Base Command

o365-sc-email-security-search-and-delete-email-office-365-quick-action

Input

Argument Name Description Required
internet_message_id The unique identifier of the email message, e.g., <abc123@mail.example.com>. Required
exchange_location Comma-separated list of mailboxes or groups. Use “All” to target everyone (may be slow). Default is All. Optional
force If true, creates a new search even if one already exists. Possible values are: false, true. Default is false. Optional

Context Output

Path Type Description
O365.SecurityAndCompliance.CaseHoldRule.Name String Case hold policy name.

Configuration parameters

  • certificate_password — Certificate Password
  • certificate — Certificate
  • delegated_auth — UPN/Email (required)
  • credentials_app_secret — UPN Password
  • organization — The organization used in app-only authentication.
  • app_id — The application ID from the Azure portal
  • credentials_app_id — The application ID from the Azure portal
  • insecure — Trust any certificate (not secure)
  • app_secret — App Secret
  • tenant_id — Tenant ID
  • credentials_tenant_id — Tenant ID
  • connection_uri — Connection URI
  • azure_ad_authorized_endpoint_uri_base — AzureADAuthorizedEndpointURI Base

Commands (25)

  • o365-sc-auth-complete

    OAuth2.0 - Complete authorization.

  • o365-sc-auth-start

    OAuth2.0 - Start authorization.

  • o365-sc-auth-test

    OAuth2.0 - Test authorization.

  • o365-sc-case-hold-policy-create

    Creates new case hold policies in the Microsoft Purview compliance portal.

  • o365-sc-case-hold-policy-delete

    Removes case hold policies from the Microsoft Purview compliance portal.

  • o365-sc-case-hold-policy-get

    View existing case hold policies in the Microsoft Purview compliance portal.

  • o365-sc-case-hold-policy-set

    Update inputs for case hold policies.

  • o365-sc-case-hold-rule-create

    Creates new case hold rules in the Microsoft Purview compliance portal.

  • o365-sc-case-hold-rule-delete

    Removes case hold rules from the Microsoft Purview compliance portal.

  • o365-sc-case-hold-rule-list

    View case hold rules in the Microsoft Purview compliance portal.

  • o365-sc-compliance-case-create

    Create eDiscovery cases in the Microsoft Purview compliance portal.

  • o365-sc-compliance-case-delete

    Removes compliance cases from the Microsoft Purview compliance portal or the Microsoft Purview compliance portal.

  • o365-sc-compliance-case-list

    List different types of compliance cases in the Microsoft Purview compliance portal.

  • o365-sc-email-security-search-and-delete-email-office-365-quick-action

    Deletes an email for all recipients.

  • o365-sc-get-search

    Gets compliance search by name from the Security & Compliance Center.

  • o365-sc-get-search-action

    Gets compliance search action from the Security & Compliance Center.

  • o365-sc-list-search

    List compliance searches in the Security & Compliance Center.

  • o365-sc-list-search-action

    Lists compliance search actions from the Security & Compliance Center.

  • o365-sc-new-search

    Create compliance search in the Security & Compliance Center.

  • o365-sc-new-search-action

    After you create a content search using the o365-sc-new-search command and run it using the o365-sc-start-search command, you assign a search action to the search using the o365-sc-new-search-action command.

  • o365-sc-remove-search

    Remove compliance search by name from the Security & Compliance Center.

  • o365-sc-remove-search-action

    Removes a compliance search action by searching for the action name in the Security & Compliance Center.

  • o365-sc-set-search

    Modifies non-running compliance searches in the Security & Compliance Center.

  • o365-sc-start-search

    Starts stopped, completed, or not started compliance search in the Security & Compliance Center.

  • o365-sc-stop-search

    Stop running compliance search in the Security & Compliance Center.

Source

SecurityAndComplianceV2.Tests.ps1 SecurityAndComplianceV2.ps1 SecurityAndComplianceV2.yml SecurityAndComplianceV2_description.md
Download History Raw 
category: Email
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: SecurityAndComplianceV2
  version: -1
configuration:
- display: Certificate Password
  name: certificate_password
  type: 4
  additionalinfo: Password used to sign the certificate.
  hidden: true
  section: Connect
  advanced: true
  required: false
- display: Certificate
  name: certificate
  type: 4
  additionalinfo: A pfx certificate encoded in Base64.
  hidden: true
  section: Connect
  advanced: true
  required: false
- display: UPN/Email
  additionalinfo: User Principal Name (UPN) of the Microsoft account used for authentication.
  name: delegated_auth
  required: true
  type: 9
  displaypassword: Password
  hiddenpassword: true
  section: Connect
- display: UPN Password
  additionalinfo: Password for the specified UPN. Required when using interactive delegated authentication. Leave this field empty when using device code based authentication.
  name: credentials_app_secret
  required: false
  type: 9
  displaypassword: UPN Password
  hiddenusername: true
  section: Connect
- display: The organization used in app-only authentication.
  name: organization
  type: 0
  section: Connect
  advanced: true
  required: false
- display: The application ID from the Azure portal
  name: app_id
  type: 0
  section: Connect
  advanced: true
  hidden: true
  required: false
- display: The application ID from the Azure portal
  name: credentials_app_id
  required: false
  type: 9
  section: Connect
  displaypassword: Password
  hiddenpassword: true
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  section: Connect
  advanced: true
  required: false
- display: App Secret
  name: app_secret
  type: 4
  section: Connect
  advanced: true
  required: false
  hidden: true
- display: Tenant ID
  name: tenant_id
  type: 0
  section: Connect
  advanced: true
  required: false
  hidden: true
- display: Tenant ID
  name: credentials_tenant_id
  required: false
  type: 9
  displaypassword: Password
  hiddenpassword: true
  section: Connect
  advanced: true
- display: Connection URI
  name: connection_uri
  type: 0
  defaultvalue: https://ps.compliance.protection.outlook.com/powershell-liveid/
  additionalinfo: Please refer to the documentation for a list of known endpoints.
  section: Connect
  advanced: true
  required: false
- display: AzureADAuthorizedEndpointURI Base
  name: azure_ad_authorized_endpoint_uri_base
  type: 0
  additionalinfo: Excluding /common or /<tenantID>
  defaultvalue: https://login.microsoftonline.com
  section: Connect
  advanced: true
  required: false
description: Deprecated. Use the Microsoft Graph Security integration instead. This integration allows you to manage and interact with Microsoft security and compliance content search.
display: O365 - Security And Compliance - Content Search v2 (Deprecated)
deprecated: true
name: SecurityAndComplianceV2
script:
  commands:
  - description: OAuth2.0 - Start authorization.
    name: o365-sc-auth-start
    arguments: []
  - description: OAuth2.0 - Complete authorization.
    name: o365-sc-auth-complete
    arguments: []
  - description: OAuth2.0 - Test authorization.
    name: o365-sc-auth-test
    arguments: []
  - description: Create compliance search in the Security & Compliance Center.
    name: o365-sc-new-search
    arguments:
    - description: |
        The name of the compliance search.
        If not specified, will have the prefix "XSOAR-" followed by the GUID e.g., XSOAR-d6228fd0-756b-4e4b-8721-76776df91526.
      name: search_name
    - description: The name of a Core eDiscovery case to associate with the new compliance search.
      name: case
    - description: Text search string or a query that is formatted using the Keyword Query Language (KQL).
      name: kql
    - description: Description of the compliance search.
      name: description
    - description: Whether to include mailboxes other than regular user mailboxes in the compliance search. Default is "false".
      name: allow_not_found_exchange_locations
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - description: Comma-separated list of mailboxes/distribution groups to include, or you can use the value "All" to include all.
      isArray: true
      name: exchange_location
      defaultValue: 'All'
    - description: Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter. Deprecated since Microsoft is supporting it only on-premise.
      isArray: true
      deprecated: true
      name: exchange_location_exclusion
    - description: Comma-separated list of public folders to include, or you can use the value "All" to include all.
      isArray: true
      name: public_folder_location
    - description: Comma-separated list of SharePoint online sites to include. You can identify the sites by their URL value, or you can use the value "All" to include all sites.
      isArray: true
      name: share_point_location
    - description: Comma-separated list of SharePoint online sites to exclude when you use the value "All" for the share_point_location argument. You can identify the sites by their URL value.
      isArray: true
      name: share_point_location_exclusion
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery
      description: Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy
      description: Security and compliance search creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime
      description: Security and compliance search creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Description
      description: Security and compliance search description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Errors
      description: Security and compliance search errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation
      description: Security and compliance search exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Identity
      description: Security and compliance search identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.IsValid
      description: Whether the security and compliance search is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Items
      description: The number of security and compliance search scanned items.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime
      description: Security and compliance search job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobId
      description: Security and compliance search job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobRunId
      description: Security and compliance search job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime
      description: Security and compliance search job run start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime
      description: Security and compliance search last modification time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LogLevel
      description: Security and compliance search Azure log level.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Name
      description: Security and compliance search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation
      description: Security and compliance search OneDrive locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion
      description: Security and compliance search OneDrive locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation
      description: Security and compliance search public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion
      description: Security and compliance search public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunBy
      description: Security and compliance search last run by UPN (Email representation).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId
      description: Security and compliance search run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation
      description: Security and compliance search SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Size
      description: Security and compliance search bytes results size.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Status
      description: Security and compliance search status.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.TenantId
      description: Security and compliance search Tenant ID.
      type: String
  - description: Modifies non-running compliance searches in the Security & Compliance Center.
    name: o365-sc-set-search
    arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    - description: Modify the text search string or a query that is formatted using the Keyword Query Language (KQL).
      name: kql
    - description: Modify the description for the compliance search.
      name: description
    - description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      name: allow_not_found_exchange_locations
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - description: Comma-separated list of added mailboxes/distribution groups to include, or you can use the value "All" to include all mailboxes.
      isArray: true
      name: add_exchange_location
    - description: Comma-separated list of added mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location (used in create new compliance search) or the add_exchange_location argument.
      isArray: true
      name: add_exchange_location_exclusion
    - description: Comma-separated list of added public folders to include, or you can use the value "All" to include all.
      isArray: true
      name: add_public_folder_location
    - description: Comma-separated list of added SharePoint online sites to include. You identify the sites by their URL value, or you can use the value "All" to include all sites.
      isArray: true
      name: add_share_point_location
    - description: Comma-separated list of added SharePoint online sites to exclude when you use the value "All" for the exchange_location (used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value.
      isArray: true
      name: add_share_point_location_exclusion
    - description: Comma-separated list of removed mailboxes/distribution group to include.
      isArray: true
      name: remove_exchange_location
    - description: Comma-separated list of removed mailboxes/distribution group to exclude when you use the value "All" for the exchange_location (Used in create new compliance search) or the add_exchange_location argument.
      isArray: true
      name: remove_exchange_location_exclusion
    - description: Comma-separated list of removed public folders to include.
      isArray: true
      name: remove_public_folder_location
    - description: Comma-separated list of removed SharePoint online sites to include. You can identify the sites by their URL value.
      isArray: true
      name: remove_share_point_location
    - description: Comma-separated list of removed SharePoint online sites to exclude when you use the value "All" for the exchange_location (Used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value.
      isArray: true
      name: remove_share_point_location_exclusion
  - description: Remove compliance search by name from the Security & Compliance Center.
    name: o365-sc-remove-search
    arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
  - description: List compliance searches in the Security & Compliance Center.
    name: o365-sc-list-search
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery
      description: Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy
      description: Security and compliance search creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime
      description: Security and compliance search creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Description
      description: Security and compliance search description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Errors
      description: Security and compliance search errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation
      description: Security and compliance search exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Identity
      description: Security and compliance search identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.IsValid
      description: Whether the security and compliance search is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Items
      description: The number of security and compliance search scanned items.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime
      description: Security and compliance search job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobId
      description: Security and compliance search job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobRunId
      description: Security and compliance search job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime
      description: Security and compliance search job run start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime
      description: Security and compliance search last modification time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LogLevel
      description: Security and compliance search Azure log level.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Name
      description: Security and compliance search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation
      description: Security and compliance search OneDrive locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion
      description: Security and compliance search OneDrive locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation
      description: Security and compliance search public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion
      description: Security and compliance search public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunBy
      description: Security and compliance search last run by UPN (Email representation).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId
      description: Security and compliance search run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation
      description: Security and compliance search SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Size
      description: Security and compliance search bytes results size.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Status
      description: Security and compliance search status.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.TenantId
      description: Security and compliance search Tenant ID.
      type: String
    arguments: []
  - arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    - description: The maximum number of results to return. If you want to return all requests that match the query, use "-1" for the value of this argument.
      name: limit
      defaultValue: '100'
    - description: Whether to include mailboxes which have no results in results entry context.
      name: all_results
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - description: Whether to export search results as json file to war-room.
      name: export
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    - description: Show search statistics. Default is "false".
      name: statistics
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    description: Gets compliance search by name from the Security & Compliance Center.
    name: o365-sc-get-search
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery
      description: Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy
      description: Security and compliance search creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime
      description: Security and compliance search creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Description
      description: Security and compliance search description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Errors
      description: Security and compliance search errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation
      description: Security and compliance search exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Identity
      description: Security and compliance search identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.IsValid
      description: Whether the security and compliance search is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Items
      description: Number of security and compliance search scanned items.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime
      description: Security and compliance search job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobId
      description: Security and compliance search job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobRunId
      description: Security and compliance search job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime
      description: Security and compliance search job run start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime
      description: Security and compliance search last modification time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LogLevel
      description: Security and compliance search the Azure log level.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Name
      description: Security and compliance search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation
      description: Security and compliance search OneDrive locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion
      description: Security and compliance search OneDrive locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation
      description: Security and compliance search public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion
      description: Security and compliance search public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunBy
      description: Security and compliance search last run by UPN (Email representation).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId
      description: Security and compliance search run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation
      description: Security and compliance search SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Size
      description: Security and compliance search bytes results size.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Status
      description: Security and compliance search status.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.TenantId
      description: Security and compliance search Tenant ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Location
      description: Security and compliance search result location.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.ItemsCount
      description: The number of security and compliance search results in location.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Size
      description: The byte size of the security and compliance search results in location.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SearchStatus
      description: The status indicating whether or not the search for a given search_name was successful.
      type: String
  - arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    description: Starts stopped, completed, or not started compliance search in the Security & Compliance Center.
    name: o365-sc-start-search
  - description: Stop running compliance search in the Security & Compliance Center.
    name: o365-sc-stop-search
    arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
  - arguments:
    - description: The name of the compliance search.
      name: search_name
      required: true
    - description: 'Search action to perform. Possible values are: "Preview" and "Purge". Default is "Preview".'
      name: action
      defaultValue: "Preview"
      auto: PREDEFINED
      predefined:
      - "Preview"
      - "Purge"
    - description: 'Purge type. Possible values are: "Soft Delete" and "HardDelete". Default is "SoftDelete".'
      name: purge_type
      auto: PREDEFINED
      defaultValue: "SoftDelete"
      predefined:
      - 'SoftDelete'
      - 'HardDelete'
    - description: 'Specifies how to export SharePoint and OneDrive search results. IndividualMessage: Export the files uncompressed. This is the default value. PerUserZip: One ZIP file for each user. Each ZIP file contains the exported files for the user. SingleZip: One ZIP file for all users. The ZIP file contains all exported files from all users. This output setting is available only in PowerShell. To specify the format for Exchange search results, use the exchange_archive_format parameter.'
      name: share_point_archive_format
      auto: PREDEFINED
      predefined:
      - 'IndividualMessage'
      - 'PerUserZip'
      - 'SingleZip'
      deprecated: true
    - description: "Specifies the format of the search results when you use the Export action. Valid values are: FxStream: Export to PST files. This is the only option that's available when you export search results from the Microsoft Purview compliance portal. Mime: Export to .eml message files. This is the default value when you use cmdlets to export the search results. Msg: Export to .msg message files."
      name: format
      auto: PREDEFINED
      predefined:
      - 'FxStream'
      - 'Mime'
      - 'Msg'
      deprecated: true
    - description: Specifies whether to export previous versions of the document when you use the Export action.
      name: include_sharepoint_document_versions
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      deprecated: true
    - description: Specifies the email address target for the search results when you use the Export action.
      name: notify_email
      deprecated: true
    - description: Specifies the cc email address target for the search results when you use the Export action.
      name: notify_email_cc
      deprecated: true
    - description: Specifies the scenario type when you use the Export action.
      name: scenario
      auto: PREDEFINED
      predefined:
      - 'AnalyzeWithZoom'
      - 'General'
      - 'GenerateReportsOnly'
      - 'Inventory'
      - 'RetentionReports'
      - 'TriagePreview'
      deprecated: true
    - description: Specifies the items to include when the action is Export.
      name: scope
      auto: PREDEFINED
      deprecated: true
      predefined:
      - 'IndexedItemsOnly'
      - 'UnindexedItemsOnly'
      - 'BothIndexedAndUnindexedItems'
    description: After you create a content search using the o365-sc-new-search command and run it using the o365-sc-start-search command, you assign a search action to the search using the o365-sc-new-search-action command.
    name: o365-sc-new-search-action
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action
      description: Security and compliance search action type. Either "Purge" or "Preview".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy
      description: Security and compliance search action creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime
      description: Security and compliance search action creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description
      description: Security and compliance search action description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors
      description: Security and compliance search action errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId
      description: Security and compliance search action job ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId
      description: Security and compliance search action run ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation
      description: Security and compliance search action exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion
      description: Security and compliance search action exchange locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity
      description: Security and compliance search action identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid
      description: Whether the security and compliance search action is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime
      description: Security and compliance search action job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId
      description: Security and compliance search action job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId
      description: Security and compliance search action job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime
      description: Security and compliance search action job start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime
      description: Security and compliance search action last modified time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name
      description: Security and compliance search action name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation
      description: Security and compliance search action public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion
      description: Security and compliance search action public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry
      description: Whether to retry if the search action failed.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy
      description: Security and compliance search action run by UPN (email address).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId
      description: Security and compliance search action run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName
      description: Security and compliance search action search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation
      description: Security and compliance search action SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion
      description: Security and compliance search action SharePoint locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status
      description: Security and compliance search action status. Either "Started" or "Completed".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId
      description: Security and compliance search action Tenant ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchStatus
      description: The status indicating whether or not the search for a given search_name was successful.
      type: String
  - arguments:
    - description: The name of the compliance search action.
      name: search_action_name
      required: true
    description: Removes a compliance search action by searching for the action name in the Security & Compliance Center.
    name: o365-sc-remove-search-action
  - description: Lists compliance search actions from the Security & Compliance Center.
    name: o365-sc-list-search-action
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action
      description: Security and compliance search action type. Either "Purge or "Preview".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy
      description: Security and compliance search action creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime
      description: Security and compliance search action creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description
      description: Security and compliance search action description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors
      description: Security and compliance search action errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId
      description: Security and compliance search action job ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId
      description: Security and compliance search action run ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation
      description: Security and compliance search action exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion
      description: Security and compliance search action exchange locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity
      description: Security and compliance search action identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid
      description: Whether the security and compliance search action is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime
      description: Security and compliance search action job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId
      description: Security and compliance search action job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId
      description: Security and compliance search action job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime
      description: Security and compliance search action job start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime
      description: Security and compliance search action last modified time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name
      description: Security and compliance search action name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation
      description: Security and compliance search action public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion
      description: Security and compliance search action public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry
      description: Whether to retry if the search action failed.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy
      description: Security and compliance search action run by UPN (email address).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId
      description: Security and compliance search action run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName
      description: Security and compliance search action search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation
      description: Security and compliance search action SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion
      description: Security and compliance search action SharePoint locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status
      description: Security and compliance search action status (Started/Completed).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId
      description: Security and compliance search action Tenant ID.
      type: String
    arguments: []
  - arguments:
    - description: The name of the compliance search action.
      name: search_action_name
      required: true
    - description: 'The maximum number of results to return. If you want to return all requests that match the query, use "-1" for the value of this argument.'
      name: limit
      defaultValue: '100'
    - description: 'Whether to export search results as json file to war-room.'
      name: export
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - description: Whether to print the results in the War Room. Default is "false".
      name: results
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    description: Gets compliance search action from the Security & Compliance Center.
    name: o365-sc-get-search-action
    outputs:
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action
      description: Security and compliance search action type. Either "Purge" or "Preview".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled
      description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled
      description: Whether the Azure Batch Framework is enabled for job processing.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId
      description: Identity of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName
      description: Name of a Core eDiscovery case which is associated with the compliance search.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy
      description: Security and compliance search action creator.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime
      description: Security and compliance search action creation time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description
      description: Security and compliance search action description.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors
      description: Security and compliance search action errors.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId
      description: Security and compliance search action job ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId
      description: Security and compliance search action run ID estimation.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation
      description: Security and compliance search action exchange locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion
      description: Security and compliance search action exchange locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity
      description: Security and compliance search action identity.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid
      description: Whether the security and compliance search action is valid.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime
      description: Security and compliance search action job end time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId
      description: Security and compliance search action job ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId
      description: Security and compliance search action job run ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime
      description: Security and compliance search action job start time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime
      description: Security and compliance search action last modified time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name
      description: Security and compliance search action name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation
      description: Security and compliance search action public folder locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion
      description: Security and compliance search action public folder locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Location
      description: Security and compliance search action result location.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ItemCount
      description: Security and compliance search action result item count.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.TotalSize
      description: Security and compliance search action result total size.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.FailedCount
      description: Security and compliance search action result failed count.
      type: Number
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Sender
      description: Security and compliance search action result mail sender.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Subject
      description: Security and compliance search action result subject.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Type
      description: Security and compliance search action result type.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Size
      description: Security and compliance search action result size.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ReceivedTime
      description: Security and compliance search action result received time.
      type: Date
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.DataLink
      description: Security and compliance search action data link.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry
      description: Whether to retry if the search action failed.
      type: Boolean
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy
      description: Security and compliance search action run by UPN (email address).
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId
      description: Security and compliance search action run space ID.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName
      description: Security and compliance search action search name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation
      description: Security and compliance search action SharePoint locations to include.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion
      description: Security and compliance search action SharePoint locations to exclude.
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status
      description: Security and compliance search action status. Either "Started" or "Completed".
      type: String
    - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId
      description: Security and compliance search action Tenant ID.
      type: String
  - name: o365-sc-compliance-case-create
    description: Create eDiscovery cases in the Microsoft Purview compliance portal.
    arguments:
    - name: case_name
      description: Case name create.
      required: true
    - name: case_type
      description: |
        "AdvancedEdiscovery: Used to manage legal or other types of investigations.
         ComplianceClassifier: This type of case corresponds to a trainable classifier.
         DataInvestigation: Data investigation cases are used to investigate data spillage incidents.
         DSR: Data Subject Request (DSR) cases are used to manage General Data Protection Regulation (GDPR) DSR investigations.
         eDiscovery: eDiscovery (also called eDiscovery Standard) cases are used to manage legal or other types of investigations.
         This is the default value.
         InsiderRisk: Insider risk cases are used to manage insider risk management cases.
         Typically, insider risk management cases are manually created in the Microsoft Purview
         compliance portal to further investigate activity based on a risk alert.
         SupervisionPolicy: This type of case corresponds to communication compliance policy."
      defaultValue: "eDiscovery"
      auto: PREDEFINED
      predefined:
      - AdvancedEdiscovery
      - ComplianceClassifier
      - DataInvestigation
      - DSR
      - eDiscovery
      - InsiderRisk
      - SupervisionPolicy
    - name: description
      description: Case description.
    - name: external_id
      description: Case external ID.
    outputs:
    - contextPath: O365.SecurityAndCompliance.ComplianceCase.Name
      description: Case name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ComplianceCase.Status
      description: Case status.
      type: String
    - contextPath: O365.SecurityAndCompliance.ComplianceCase.CreatedDateTime
      description: Case created date time.
      type: String
  - name: o365-sc-compliance-case-list
    description: List different types of compliance cases in the Microsoft Purview compliance portal.
    arguments:
    - name: identity
      description: List cases by identity.
    - name: case_type
      description: Comma-separated closed list of Case Types to filter by.
      isArray: true
      auto: PREDEFINED
      predefined:
      - AdvancedEdiscovery
      - ComplianceClassifier
      - DataInvestigation
      - DSR
      - eDiscovery
      - InsiderRisk
      - SupervisionPolicy
    - name: limit
      description: Limit returned cases list size.
      defaultValue: '50'
    outputs:
    - contextPath: O365.SecurityAndCompliance.ComplianceCase.Name
      description: Case name.
      type: String
    - contextPath: O365.SecurityAndCompliance.ComplianceCase.Status
      description: Case status.
      type: String
    - contextPath: O365.SecurityAndCompliance.ComplianceCase.GUID
      description: Case GUID.
      type: UUID
    - contextPath: O365.SecurityAndCompliance.ComplianceCase.CreatedDateTime
      description: Case created date time.
      type: String
  - name: o365-sc-compliance-case-delete
    description: Removes compliance cases from the Microsoft Purview compliance portal or the Microsoft Purview compliance portal.
    arguments:
    - name: identity
      description: Delete case by identity.
      required: true
  - name: o365-sc-case-hold-policy-create
    description: Creates new case hold policies in the Microsoft Purview compliance portal.
    arguments:
    - name: policy_name
      description: Name of the policy to create.
      required: true
    - name: case
      description: eDiscovery case, Case Name, Case Identity (GUID value).
      required: true
    - name: comment
      description: Attach a comment to the case.
    - name: exchange_location
      description: Mailbox or distribution group.
      isArray: true
    - name: public_folder_location
      description: Comma-separated list of public folders to include, or you can use the value "All" to include all.
      isArray: true
    - name: share_point_location
      description: SharePoint Online and OneDrive for Business sites to include.
      isArray: true
    - name: enabled
      description: Set hold policy as enabled or not.
      auto: PREDEFINED
      defaultValue: 'true'
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Name
      description: Case hold policy name.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Workload
      description: Case hold policy workload.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Enabled
      description: Is case hold policy enabled.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Mode
      description: Case hold policy mode.
      type: String
  - name: o365-sc-case-hold-policy-get
    description: View existing case hold policies in the Microsoft Purview compliance portal.
    arguments:
    - name: identity
      description: Identity of the case hold policy to get.
    - name: case
      description: Case of policy to get. Case name or case GUID.
    - name: distribution_detail
      description: Whether to include distribution details or not.
      auto: PREDEFINED
      defaultValue: 'true'
      predefined:
      - 'true'
      - 'false'
    - name: include_bindings
      description: Whether to include bindings or not.
      auto: PREDEFINED
      defaultValue: 'true'
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Name
      description: Case hold policy name.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.GUID
      description: Case hold policy GUID.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Workload
      description: Case hold policy workload.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Status
      description: Case hold policy status.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Mode
      description: Case hold policy mode.
      type: String
  - name: o365-sc-case-hold-policy-delete
    description: Removes case hold policies from the Microsoft Purview compliance portal.
    arguments:
    - name: identity
      description: Identify of the case hold policy to delete.
      required: true
    - name: force_delete
      description: Whether to use force delete or not. Can be used if current policy status is pending delete.
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
  - name: o365-sc-case-hold-rule-create
    description: Creates new case hold rules in the Microsoft Purview compliance portal.
    arguments:
    - name: rule_name
      description: Create rule with the specified name.
      required: true
    - name: policy_name
      description: Create rule for the specified policy.
      required: true
    - name: query
      description: Query using Keyword Query Language (KQL).
    - name: comment
      description: Attach a comment to the created rule.
    - name: is_disabled
      description: Whether the rule is disabled or not.
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Name
      description: Case hold policy name.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Status
      description: Case hold policy status.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Mode
      description: Case hold policy mode.
      type: String
  - name: o365-sc-case-hold-rule-list
    description: View case hold rules in the Microsoft Purview compliance portal.
    arguments:
    - name: identity
      description: Get hold rule list by identity.
    - name: policy
      description: Get hold rule list by policy.
    - name: limit
      description: Limit the returned items list size.
      defaultValue: '50'
    outputs:
    - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Name
      description: Case hold policy name.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldRule.GUID
      description: Case hold policy GUID.
      type: UUID
    - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Enabled
      description: Whether case hold policy is enabled.
      type: String
    - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Mode
      description: Case hold policy mode.
      type: String
  - name: o365-sc-case-hold-rule-delete
    description: Removes case hold rules from the Microsoft Purview compliance portal.
    arguments:
    - name: identity
      description: Delete rule by identity.
    - name: force_delete
      description: Whether to use force delete or not. Can be used if current rule status is pending delete.
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
  - arguments:
    - description: Identity of the policy to update.
      name: identity
      required: true
    - description: Exchange locations to add to the policy.
      isArray: true
      name: add_exchange_locations
    - description: Sharepoint locations to add to the policy.
      isArray: true
      name: add_sharepoint_locations
    - description: Public locations to add to the policy.
      isArray: true
      name: add_public_locations
    - description: Exchange locations to remove from the policy.
      isArray: true
      name: remove_exchange_locations
    - description: Sharepoint locations to remove from the policy.
      isArray: true
      name: remove_sharepoint_locations
    - description: Public locations to remove from the policy.
      isArray: true
      name: remove_public_locations
    - description: Add a comment to existing policy.
      name: comment
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Enable or disable the policy.
      name: enabled
      predefined:
      - 'true'
      - 'false'
    description: Update inputs for case hold policies.
    name: o365-sc-case-hold-policy-set
  - name: o365-sc-email-security-search-and-delete-email-office-365-quick-action
    prettyname: "[Email Security] Search And Delete Email - Office 365"
    hidden: true
    quickaction: true
    polling: true
    description: Deletes an email for all recipients.
    arguments:
    - name: internet_message_id
      description: The unique identifier of the email message, e.g., <abc123@mail.example.com>.
      required: true
      prettyname: Internet message ID
      auto: PREDEFINED
      prettypredefined:
        Issue Internet message ID: ${issue.xdmemailmessageid}
    - name: exchange_location
      prettyname: Exchange Location
      description: Comma-separated list of mailboxes or groups. Use "All" to target everyone (may be slow).
      isArray: true
      defaultValue: 'All'
      auto: PREDEFINED
      prettypredefined:
        All: 'All'
    - name: force
      prettyname: Force
      description: If true, creates a new search even if one already exists.
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
    - name: polling_first_run
      description: For polling use.
      defaultValue: true
      hidden: true
    - name: search_name
      description: For polling use.
      hidden: true
    outputs:
    - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Name
      description: Case hold policy name.
      type: String
  dockerimage: demisto/pwsh-exchangev3:1.0.0.4904712
  runonce: true
  script: ''
  type: powershell
fromversion: 5.5.0
supportsquickactions: true
tests:
- No tests (deprecated)
autoUpdateDockerImage: false