O365 - Security And Compliance - Search Deprecated

deprecated: true
description: |-
  Deprecated. Use the Microsoft Graph Security - Search And Delete Emails playbook instead.
  This playbook perform:
  1. Creates a new compliance search action - Preview (Base on created compliance search).
  2. Waits for the preview action to complete.
  3. Retrieves the preview results.
id: O365 - Security And Compliance - Search Action - Preview
inputs:
- key: search_name
  value: {}
  required: true
  description: The name of the compliance search.
  playbookInputQuery:
- key: polling_interval
  value:
    simple: "1"
  required: false
  description: Search action polling interval.
  playbookInputQuery:
- key: polling_timeout
  value:
    simple: "10"
  required: false
  description: Search action polling timeout.
  playbookInputQuery:
name: O365 - Security And Compliance - Search Action - Preview
outputs:
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action
  description: Security and compliance search action type. Either "Purge" or "Preview".
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled
  description: Whether to include mailboxes other than regular user mailboxes in the compliance search.
  type: Boolean
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled
  description: Whether the Azure Batch Framework is enabled for job processing.
  type: Boolean
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId
  description: Identity of a Core eDiscovery case which is associated with the compliance search.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName
  description: Name of a Core eDiscovery case which is associated with the compliance search.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy
  description: Security and compliance search action creator.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime
  description: Security and compliance search action creation time.
  type: Date
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description
  description: Security and compliance search action description.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors
  description: Security and compliance search action errors.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId
  description: Security and compliance search action job ID estimation.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId
  description: Security and compliance search action run ID estimation.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation
  description: Security and compliance search action exchange locations to include.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion
  description: Security and compliance search action exchange locations to exclude.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity
  description: Security and compliance search action identity.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid
  description: Whether the security and compliance search action is valid.
  type: Boolean
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime
  description: Security and compliance search action job end time.
  type: Date
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId
  description: Security and compliance search action job ID.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId
  description: Security and compliance search action job run ID.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime
  description: Security and compliance search action job start time.
  type: Date
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime
  description: Security and compliance search action last modified time.
  type: Date
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name
  description: Security and compliance search action name.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation
  description: Security and compliance search action public folder locations to include.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion
  description: Security and compliance search action public folder locations to exclude.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results
  description: Security and compliance search action results.
  type: unknown
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry
  description: Whether to retry if the search action failed.
  type: Boolean
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy
  description: Security and compliance search action run by UPN (email address).
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId
  description: Security and compliance search action run space ID.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName
  description: Security and compliance search action search name.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation
  description: Security and compliance search action SharePoint locations to include.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion
  description: Security and compliance search action SharePoint locations to exclude.
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status
  description: Security and compliance search action status. Either "Started" or "Completed".
  type: String
- contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId
  description: Security and compliance search action Tenant ID.
  type: String
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e9df5f91-1e9e-4fa8-87eb-6f0df3714bc1
    type: start
    task:
      id: e9df5f91-1e9e-4fa8-87eb-6f0df3714bc1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "3":
    id: "3"
    taskid: 3465b210-3e8c-4e68-82d8-a71d09b64106
    type: playbook
    task:
      id: 3465b210-3e8c-4e68-82d8-a71d09b64106
      version: -1
      name: Waiting for search action to complete
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      Ids:
        complex:
          root: O365.SecurityAndCompliance.ContentSearch
          accessor: SearchAction
          transformers:
          - operator: DT
            args:
              dt:
                value:
                  simple: '.=val.SearchStatus!=="NotFound" ? val.Name : val.Name + "_Preview"'
      Interval:
        simple: ${inputs.polling_interval}
      PollingCommandArgName:
        simple: search_action_name
      PollingCommandName:
        simple: o365-sc-get-search-action
      Timeout:
        simple: ${inputs.polling_timeout}
      dt:
        simple: O365.SecurityAndCompliance.ContentSearch.SearchAction(val.Status && val.Status == "InProgress" || val.Status == "Starting" || val.Status == "Purging").Name
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "4":
    id: "4"
    taskid: a3b5cc33-9b80-4aa9-8413-a5ad3567168c
    type: title
    task:
      id: a3b5cc33-9b80-4aa9-8413-a5ad3567168c
      version: -1
      name: Search action completed.
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "6":
    id: "6"
    taskid: 1a18141a-1cfd-4843-8fc4-2f1db333e66d
    type: regular
    task:
      id: 1a18141a-1cfd-4843-8fc4-2f1db333e66d
      version: -1
      name: Search action - Preview
      description: After you create a content search using the !o365-sc-new-search command and run it using the !o365-sc-start-search command, you assign a search action to the search using the !o365-sc-new-search-action command.
      script: '|||o365-sc-new-search-action'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
      '#error#':
      - "8"
    scriptarguments:
      action:
        simple: Preview
      retry-count:
        simple: "10"
      search_name:
        complex:
          root: inputs.search_name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerror: true
    continueonerrortype: errorPath
  "7":
    id: "7"
    taskid: 84d44b24-58e7-49aa-8747-b9f0cbf9bb5f
    type: regular
    task:
      id: 84d44b24-58e7-49aa-8747-b9f0cbf9bb5f
      version: -1
      name: Get preview results
      description: Get the compliance search action from the Security & Compliance Center.
      script: '|||o365-sc-get-search-action'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      export:
        simple: "true"
      results:
        simple: "true"
      retry-count:
        simple: "10"
      search_action_name:
        complex:
          root: O365.SecurityAndCompliance.ContentSearch.SearchAction
          accessor: Name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "8":
    id: "8"
    taskid: 4c31505d-360d-4069-af68-09ad2c63e5b3
    type: regular
    task:
      id: 4c31505d-360d-4069-af68-09ad2c63e5b3
      version: -1
      name: Search preview is not supported
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      value:
        simple: Email search preview could not be completed. This parameter is functional only in on-premises Exchange.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 540,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 730,
        "width": 870,
        "x": 50,
        "y": 50
      }
    }
  }
version: -1
fromversion: 5.5.0
tests:
- No tests (deprecated)
supportedModules:
- agentix
- cloud
- xsiam
- edr
- cloud_runtime_security
contentitemexportablefields:
  contentitemfields: {}