Microsoft Graph

Unified gateway to security insights - all from a unified Microsoft Graph Security API.

Category

Analytics & SIEM

Pack

MicrosoftGraphSecurity

Configuration parameters

• azure_cloud — Azure Cloud
• host — Host URL
• creds_auth_id —
• creds_tenant_id —
• creds_enc_key —
• auth_id — Application ID or Client ID
• tenant_id — Token or Tenant ID
• enc_key — Key or Client Secret
• creds_certificate — Certificate Thumbprint
• certificate_thumbprint — Certificate Thumbprint
• private_key — Private Key
• redirect_uri — Application redirect URI (for self-deployed mode)
• auth_code — Authorization code
• use_managed_identities — Use Azure Managed Identities
• managed_identities_client_id —
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• self_deployed — Use a self-deployed Azure application
• isFetch — Fetch incidents
• incidentFetchInterval — Incidents Fetch Interval
• incidentType — Incident type
• fetch_incidents_type — Fetch incidents type
• fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• fetch_limit — Fetch limit per type
• fetch_service_sources — Alerts Service Sources
• fetch_filter — Alerts Filter
• fetch_incidents_filter — Incidents Filter
• microsoft_365_defender_context — Microsoft 365 Defender context

Commands (48)

• ms-graph-security-auth-reset — Run this command if for some reason you need to rerun the authentication process.
• msg-activate-ediscovery-custodian — Activate a custodian that has been released from a case to make them part of the case again. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery-manage-new-custodians?view=o365-worldwide#re-activate-custodian.
• msg-advanced-hunting — Advanced hunting is a threat-hunting tool that uses specially constructed queries to examine the past 30 days of event data in Microsoft Graph Security.
• msg-apply-hold-ediscovery-custodian — Start the process of applying hold on eDiscovery custodians. Available return statuses: notApplied - The custodian is not on hold (all sources in it are not on hold). applied - The custodian is on hold (all sources are on hold). applying - The custodian is in applying the hold state (applyHold operation triggered). removing - The custodian is in removing the hold state(removeHold operation triggered). partial - The custodian is in a mixed state where some sources are on hold and some not on hold or error state.
• msg-auth-test — Tests connectivity to Microsoft Graph Security.
• msg-close-ediscovery-case — Close an eDiscovery case. When the legal case or investigation supported by a eDiscovery (Standard) case is completed, you can close the case. Here's what happens when you close a case: If the case contains any eDiscovery holds, they'll be turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This helps prevent content from being immediately deleted and provides admins the opportunity to search for and restore content before it may be permanently deleted after the delay hold period expires. For more information, see Removing content locations from an eDiscovery hold. Closing a case only turns off the holds that are associated with that case. If other holds are placed on a content location (such as a Litigation Hold, a retention policy, or a hold from a different eDiscovery (Standard) case) those holds will still be maintained. The case is still listed on the eDiscovery (Standard) page in the Microsoft Purview compliance portal. The details, holds, searches, and members of a closed case are retained. You can edit a case after it's closed. For example, you can add or remove members, create searches, and export search results. The primary difference between active and closed cases is that eDiscovery holds are turned off when a case is closed.
• msg-create-alert-comment — Create a comment for an existing alert.
• msg-create-ediscovery-case — Create a new eDiscovery case. This command only creates an eDiscovery (Premium) case using the new case format. To learn more about the new case format in eDiscovery, see https://learn.microsoft.com/en-us/microsoft-365/compliance/advanced-ediscovery-new-case-format.
• msg-create-ediscovery-case-hold-policy — Create a new ediscoveryHoldPolicy object.
• msg-create-ediscovery-custodian — Create a new ediscoveryCustodian object. After the custodian object is created, you will need to create the custodian's userSource to reference their mailbox and OneDrive for Business site.
• msg-create-ediscovery-custodian-site-source — Create a new siteSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
• msg-create-ediscovery-custodian-user-source — Create a new userSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
• msg-create-ediscovery-non-custodial-data-source — Create a new eDiscoveryNoncustodialDataSource object.
• msg-create-ediscovery-search — Create a new eDiscoverySearch object.
• msg-create-email-file-assessment-request — Create email file assessment request.
• msg-create-file-assessment-request — Create file assessment request.
• msg-create-mail-assessment-request — Create and retrieve a mail threat assessment.
• msg-create-url-assessment-request — Create the URL assessment request.
• msg-delete-ediscovery-case — Delete an eDiscovery case. Before you can delete a case, you must first delete all holds listed on the holds page of the case. That includes deleting holds with a status of Off. Default hold policies can only be deleted when the hold is turned off. You must close an active case to turn off any default hold policies in the case. Once the holds are turned off for default hold policies, they can be deleted.
• msg-delete-ediscovery-case-hold-policy — Delete an eDiscovery hold policy. This command submits a deletion request to Microsoft Graph; the policy may not be removed immediately and can take some time to complete.
• msg-delete-ediscovery-search — Delete an eDiscoverySearch object.
• msg-export-result-ediscovery-data — Export results from an estimated ediscoverySearch. For details, see Manage a collection estimate (https://learn.microsoft.com/en-us/purview/ediscovery-create-draft-collection#manage-a-collection-estimate).
• msg-generate-login-url — Generate the login URL used for authorization code flow.
• msg-get-alert-details — Get details for a specific alert.
• msg-get-last-estimate-statistics-operation — Retrieves the most recent eDiscovery estimate statistics operation for a given search in Microsoft Purview. Use this command after running 'msg-run-estimate-statistics' to check the results.
• msg-get-user — Deprecated. Use the Entra ID Users integration instead.
• msg-get-users — Deprecated. Use the Entra ID Users integration instead.
• msg-list-case-operation — Get a list of the caseOperation objects and their properties, or retrieve a specific operation by ID. When operation_id is provided, you can set download_file=true to download the export report (if available).
• msg-list-ediscovery-case-hold-policy — Get a list of the ediscoveryHoldPolicy objects and their properties.
• msg-list-ediscovery-cases — Get a list of the eDiscovery cases.
• msg-list-ediscovery-custodian-site-sources — Get a list of the siteSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
• msg-list-ediscovery-custodian-user-sources — Get a list of the userSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
• msg-list-ediscovery-custodians — Get a list of the custodians on a given eDiscovery case.
• msg-list-ediscovery-non-custodial-data-sources — Get a list of the non-custodial data sources and their properties.
• msg-list-ediscovery-searchs — Get a list of eDiscoverySearch resources from an eDiscovery case.
• msg-list-security-incident — Get a list of incident objects that Microsoft graph created to track attacks in an organization. If you want a specific incident, just enter incident_id.
• msg-list-threat-assessment-requests — Get a list of the threat assessment requests.
• msg-purge-ediscovery-data — Deletes mailbox items in Exchange or messages in Microsoft Teams that are included in an eDiscovery search. You can collect and purge the following categories of Teams content: Teams 1:1 chats - Chat messages, posts, and attachments shared in a Teams conversation between two people. Teams 1:1 chats are also called conversations. Teams group chats - Chat messages, posts, and attachments shared in a Teams conversation between three or more people. Also called 1:N chats or group conversations. Teams channels - Chat messages, posts, replies, and attachments shared in a standard Teams channel. Private channels - Message posts, replies, and attachments shared in a private Teams channel. Shared channels - Message posts, replies, and attachments shared in a shared Teams channel.
• msg-release-ediscovery-custodian — Release a custodian from a case. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/manage-new-custodians#release-a-custodian-from-a-case.
• msg-remove-hold-ediscovery-custodian — Start the process of removing a hold from eDiscovery custodians.
• msg-reopen-ediscovery-case — Reopen an eDiscovery case. When you reopen an eDiscovery (Premium) case, any holds that were in place when the case was closed won't be automatically reinstated. After the case is reopened, you'll have to go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, and then set the Status toggle to On.
• msg-run-estimate-statistics — Starts an eDiscovery estimate statistics operation in Microsoft Purview. The operation calculates the size and number of items matching the search query.
• msg-search-alerts — Get a list of alerts (security issues) within a customer's tenant that Microsoft or partner security solutions have identified.
• msg-update-alert — Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions using its reference ID.
• msg-update-ediscovery-case — Update an eDiscovery case.
• msg-update-ediscovery-case-hold-policy — Update the properties of an ediscoveryHoldPolicy object.
• msg-update-ediscovery-search — Update an eDiscoverySearch object.
• msg-update-security-incident — Update the incident with the given ID.