Google Vault - Search Drive

This is a playbook for performing Google Vault search in Drive accounts and display the results.

Google Vault · 10 tasks · 18 inputs · 17 outputs

Inputs

  • matterID — matterID
  • exportName — exportName
  • dataScope — Choice of Search scope
  • searchMethod — Choice of Search method. Default is: 'Specific Accounts' -requires emails argument. 'Organizational Unit' - requires ou argument. 'Team Drive'
  • emails — If the search method is set to Specific Accounts (separated by comma)
  • ou — If the search method is set to Specific Accounts (separated by comma)
  • teamDrive — If the search method is set to Team Drives
  • includeTeamDrives — Include/Exclude team drives
  • timeFrame — Search time frame. E.g: "1 min ago","2 weeks ago","3 months ago"
  • startTime — UTC start time (2018-10-16T12:59:02.584000Z)
  • endTime — UTC end time (2018-10-16T12:59:02.584000Z)
  • terms — Add specific terms for the search (subject:example)
  • exportPST — Export format
  • exportMBOX — Export format
  • pollInterval — Interval to check export status (minutes) For big data inquires increase both 'pollInterval' and 'pollTimeout'
  • pollTimeout — Timeout to terminate the poll (minutes). For big data inquires increase both 'pollTimeout' and 'pollInterval'
  • maxResultForDisplay — The maximal number of result to be displayed
  • downloadFile — If set to true the export file created will be downloaded into the War Room

Outputs

  • GoogleVault.Matter.Export.MatterID — Matter ID
  • GoogleVault.Matter.Export.ExportID — Export ID
  • GoogleVault.Matter.Export.Name — Export's name
  • GoogleVault.Matter.Export.CreateTime — Export's creation time
  • GoogleVault.Matter.Export.Results.Title — Title of the file
  • GoogleVault.Matter.Export.Results.Author — Author of the file
  • GoogleVault.Matter.Export.Results.Others — Other users related to the file
  • GoogleVault.Matter.Export.Results.Viewers — Viewers of the file
  • GoogleVault.Matter.Export.Results.DateModified — The date the file was modified
  • GoogleVault.Matter.Export.Results.DateCreated — The date the file was created
  • GoogleVault.Matter.Export.Results.DocType — The type of the file (extension)
  • GoogleVault.Matter.Export.Results.MD5 — The MD5 of the file (SHA1)
  • GoogleVault.Matter.Export.Status — Export Status (COMPLETED,FAILED,IN_PROGRESS)
  • GoogleVault.Matter.Export.BucketName — Bucket holder name for this export
  • GoogleVault.Matter.Export.DownloadID — ID to be used by the download-export command
  • GoogleVault.Matter.Export.ViewID — ID to be used by the get-X-results command (X=drive/mail/groups)
  • GoogleVault.Matter — Matter object

Commands used

gvault-create-export-drive gvault-download-results gvault-export-status gvault-get-drive-results

Flowchart

yes yes Start Start Create Drive Export - gvault-create-export-drive Create Drive Export gvault-create-export-drive GenericPolling - GenericPolling GenericPolling GenericPolling Get Drive results - gvault-get-drive-results Get Drive results gvault-get-drive-results Done Done Check downloadFile Check downloadFile Get Export status to context - gvault-export-status Get Export status to context gvault-export-status Download Export file - gvault-download-results Download Export file gvault-download-results Check if status COMPLETED Check if status COMPLETED Polling Timeout - PrintErrorEntry Polling Timeout PrintErrorEntry