O365 - Security And Compliance - Search And Delete

Deprecated. Use the Microsoft Graph Security - Search And Delete Emails playbook instead. This playbook performs the following steps: 1. Creates a compliance search. 2. Starts a compliance search. 3. Waits for the compliance search to complete. 4. Gets the results of the compliance search. 5. Gets the preview results, if specified. 6. Deletes the search results (Hard/Soft).

Pack

MicrosoftExchangeOnline

Tasks

19

Inputs

• search_name — The name of the compliance search.
• case — The name of a Core eDiscovery case to associate with the new compliance search.
• kql — Text search string or a query that is formatted using the Keyword Query Language (KQL).
• description — Description of the compliance search.
• allow_not_found_exchange_locations — Whether to include mailboxes other than regular user mailboxes in the compliance search. Default is "false".
• exchange_location — Comma-separated list of mailboxes/distribution groups to include, or use the value "All" to include all.
• exchange_location_exclusion — Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter.
• force — Whether to replace the existing search. If "true", the existing search will be removed and a new search will be created. If "false", the existing search will be used and any new search configurations will be ignored.
• preview — Whether to preview the results using the search action "Preview". Possible values are: "true" and "false" or leave empty to select manually.
• delete_type — Specify the delete type to perform on the search results. Possible values are Hard and Soft or leave empty to select manually. (Hard = Unrecoverable, Soft=Recoverable)
• search_action_polling_timeout — Amount of time to poll before declaring a timeout for the search action and resuming the playbook (in minutes).
• search_action_polling_interval — The frequency that the polling command will run for the search action that was chosen.

Commands used

• o365-sc-remove-search
• o365-sc-remove-search-action