O365 - Security And Compliance - Search Deprecated

Deprecated. Use the Microsoft Graph Security - Search And Delete Emails playbook instead. This playbook performs the following steps: 1. Creates a compliance search. 2. Starts a compliance search. 3. Waits for the compliance search to complete. 4. Gets the results of the compliance search as an output. 5. Gets the preview results, if specified.

Microsoft Exchange Online · 15 tasks · 14 inputs · 63 outputs

Inputs

  • search_name — The name of the compliance search.
  • force — If false, use the existing search without modifying any search parameters. If true, overwrite the existing search. Possible values are: "true" and "false".
  • preview — Whether to preview results using the search action. Possible values are: "true" and "false".
  • case — The name of a Core eDiscovery case to associate with the new compliance search.
  • kql — Text search string or a query that is formatted using the Keyword Query Language (KQL).
  • description — Description of the compliance search.
  • allow_not_found_exchange_locations — Whether to include mailboxes other than regular user mailboxes in the compliance search. Possible values are: "true" and "false".
  • exchange_location — Comma-separated list of mailboxes/distribution groups to include, or use the value "All" to include all.
  • exchange_location_exclusion — Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter.
  • public_folder_location — Comma-separated list of public folders to include, or use the value "All" to include all.
  • share_point_location — Comma-separated list of SharePoint online sites to include. You can identify the sites by their URL value, or use the value "All" to include all sites.
  • share_point_location_exclusion — Comma-separated list of SharePoint online sites to exclude when you use the value "All" for the share_point_location argument. You can identify the sites by their URL value.
  • polling_interval — Compliance search polling interval
  • polling_timeout — Compliance search polling timeout.

Outputs

  • O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled — Whether to include mailboxes other than regular user mailboxes in the compliance search.
  • O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled — Whether the Azure Batch Framework is enabled for job processing.
  • O365.SecurityAndCompliance.ContentSearch.Search.CaseId — Identity of a Core eDiscovery case which is associated with the compliance search.
  • O365.SecurityAndCompliance.ContentSearch.Search.CaseName — Name of a Core eDiscovery case which is associated with the compliance search.
  • O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery — Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
  • O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy — Security and compliance search creator.
  • O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime — Security and compliance search creation time.
  • O365.SecurityAndCompliance.ContentSearch.Search.Description — Security and compliance search description.
  • O365.SecurityAndCompliance.ContentSearch.Search.Errors — Security and compliance search errors.
  • O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation — Security and compliance search exchange locations to include.
  • O365.SecurityAndCompliance.ContentSearch.Search.Identity — Security and compliance search identity.
  • O365.SecurityAndCompliance.ContentSearch.Search.IsValid — Whether the security and compliance search is valid.
  • O365.SecurityAndCompliance.ContentSearch.Search.Items — Number of security and compliance search scanned items.
  • O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime — Security and compliance search job end time.
  • O365.SecurityAndCompliance.ContentSearch.Search.JobId — Security and compliance search job ID.
  • O365.SecurityAndCompliance.ContentSearch.Search.JobRunId — Security and compliance search job run ID.
  • O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime — Security and compliance search job run start time.
  • O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime — Security and compliance search last modification time.
  • O365.SecurityAndCompliance.ContentSearch.Search.LogLevel — Security and compliance search Azure log level.
  • O365.SecurityAndCompliance.ContentSearch.Search.Name — Security and compliance search name.
  • O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation — Security and compliance search OneDrive locations to include.
  • O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion — Security and compliance search OneDrive locations to exclude.
  • O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation — Security and compliance search public folder locations to include.
  • O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion — Security and compliance search public folder locations to exclude.
  • O365.SecurityAndCompliance.ContentSearch.Search.RunBy — Security and compliance search last run by UPN (Email representation).
  • O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId — Security and compliance search run space ID.
  • O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation — Security and compliance search SharePoint locations to include.
  • O365.SecurityAndCompliance.ContentSearch.Search.Size — Security and compliance search bytes results size.
  • O365.SecurityAndCompliance.ContentSearch.Search.Status — Security and compliance search status.
  • O365.SecurityAndCompliance.ContentSearch.Search.TenantId — Security and compliance search Tenant ID.
  • O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults — Security and compliance search results.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.Action — Security and compliance search action type. Either "Purge" or "Preview".
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled — Whether to include mailboxes other than regular user mailboxes in the compliance search.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled — Whether the Azure Batch Framework is enabled for job processing.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId — Identity of a Core eDiscovery case which is associated with the compliance search.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName — Name of a Core eDiscovery case which is associated with the compliance search.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy — Security and compliance search action creator.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime — Security and compliance search action creation time.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.Description — Security and compliance search action description.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors — Security and compliance search action errors.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId — Security and compliance search action job ID estimation.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId — Security and compliance search action run ID estimation.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation — Security and compliance search action exchange locations to include.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion — Security and compliance search action exchange locations to exclude.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity — Security and compliance search action identity.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid — Whether the security and compliance search action is valid.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime — Security and compliance search action job end time.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId — Security and compliance search action job ID.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId — Security and compliance search action job run ID.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime — Security and compliance search action job start time.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime — Security and compliance search action last modified time.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.Name — Security and compliance search action name.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation — Security and compliance search action public folder locations to include.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion — Security and compliance search action public folder locations to exclude.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.Results — Security and compliance search action results.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry — Whether to retry if the search action failed.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy — Security and compliance search action run by UPN (email address).
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId — Security and compliance search action run space ID.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName — Security and compliance search action search name.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation — Security and compliance search action SharePoint locations to include.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion — Security and compliance search action SharePoint locations to exclude.
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.Status — Security and compliance search action status. Either "Started" or "Completed".
  • O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId — Security and compliance search action Tenant ID.

Commands used

o365-sc-get-search o365-sc-new-search o365-sc-remove-search o365-sc-start-search

Flowchart

yes yes Existing search Force yes yes Start Start Waiting for the compliance search to complete. - GenericPolling Waiting for the complianc... GenericPolling Search completed Search completed Start search - o365-sc-start-search Start search o365-sc-start-search Get compliance search - o365-sc-get-search Get compliance search o365-sc-get-search Does the compliance search exist? Does the compliance searc... Create compliance search - o365-sc-new-search Create compliance search o365-sc-new-search Whether to preview the search results. Whether to preview the se... Whether to overwrite the existing search. Whether to overwrite the ... Remove a compliance search. - o365-sc-remove-search Remove a compliance search. o365-sc-remove-search O365 - Security And Compliance - Search Action - Preview - O365 - Security And Compliance - Search Action - Preview O365 - Security And Compl... O365 - Security And Complianc... Error - Invalid force parameter - PrintErrorEntry Error - Invalid force par... PrintErrorEntry Get compliance search - o365-sc-get-search Get compliance search o365-sc-get-search Check if search_name is defined. Check if search_name is d... Is O365 Security And Compliance enabled? Is O365 Security And Comp...