O365 - Security And Compliance - Search Deprecated

Deprecated. Use the Microsoft Graph Security - Search And Delete Emails playbook instead. This playbook performs the following steps: 1. Creates a compliance search. 2. Starts a compliance search. 3. Waits for the compliance search to complete. 4. Gets the results of the compliance search as an output. 5. Gets the preview results, if specified.

Microsoft Exchange Online · 15 tasks · 14 inputs · 63 outputs

Details

ID	`O365 - Security And Compliance - Search`
From Version	5.5.0
Tasks	15

README

This playbook performs the following steps:

Creates a compliance search.
Starts a compliance search.
Waits for the compliance search to complete.
Gets the results of the compliance search as an output.
Gets the preview results, if specified.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling
O365 - Security And Compliance - Search Action - Preview

Integrations

SecurityAndCompliance

Scripts

PrintErrorEntry

Commands

o365-sc-get-search
o365-sc-new-search
o365-sc-start-search
o365-sc-remove-search

Playbook Inputs

Name	Description	Default Value	Required
search_name	The name of the compliance search. If not specified will have prefix of “XSOAR-“ and GUID e.g. XSOAR-d6228fd0-756b-4e4b-8721-76776df91526.		Optional
force	If false, use the existing search without modifying any search parameters. If true, overwrite the existing search. Possible values are: “true” and “false”.	false	Required
preview	Whether to preview results using the search action. Possible values are: “true” and “false”.	false	Required
case	The name of a Core eDiscovery case to associate with the new compliance search.		Optional
kql	Text search string or a query that is formatted using the Keyword Query Language (KQL).		Optional
description	Description of the compliance search.		Optional
allow_not_found_exchange_locations	Whether to include mailboxes other than regular user mailboxes in the compliance search. Possible values are: “true” and “false”.	true	Optional
exchange_location	Comma-separated list of mailboxes/distribution groups to include, or use the value “All” to include all.	All	Required
exchange_location_exclusion	Comma-separated list of mailboxes/distribution groups to exclude when you use the value “All” for the exchange_location parameter.		Optional
public_folder_location	Comma-separated list of public folders to include, or use the value “All” to include all.		Optional
share_point_location	Comma-separated list of SharePoint online sites to include. You can identify the sites by their URL value, or use the value “All” to include all sites.		Optional
share_point_location_exclusion	Comma-separated list of SharePoint online sites to exclude when you use the value “All” for the share_point_location argument. You can identify the sites by their URL value.		Optional
polling_interval	Compliance search polling interval	3	Optional
polling_timeout	Compliance search polling timeout.	45	Optional

Playbook Outputs

Path	Description	Type
O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled	Whether to include mailboxes other than regular user mailboxes in the compliance search.	Boolean
O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled	Whether the Azure Batch Framework is enabled for job processing.	Boolean
O365.SecurityAndCompliance.ContentSearch.Search.CaseId	Identity of a Core eDiscovery case which is associated with the compliance search.	String
O365.SecurityAndCompliance.ContentSearch.Search.CaseName	Name of a Core eDiscovery case which is associated with the compliance search.	String
O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery	Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).	String
O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy	Security and compliance search creator.	String
O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime	Security and compliance search creation time.	Date
O365.SecurityAndCompliance.ContentSearch.Search.Description	Security and compliance search description.	String
O365.SecurityAndCompliance.ContentSearch.Search.Errors	Security and compliance search errors.	String
O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation	Security and compliance search exchange locations to include.	String
O365.SecurityAndCompliance.ContentSearch.Search.Identity	Security and compliance search identity.	String
O365.SecurityAndCompliance.ContentSearch.Search.IsValid	Whether the security and compliance search is valid.	Boolean
O365.SecurityAndCompliance.ContentSearch.Search.Items	Number of security and compliance search scanned items.	Number
O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime	Security and compliance search job end time.	Date
O365.SecurityAndCompliance.ContentSearch.Search.JobId	Security and compliance search job ID.	String
O365.SecurityAndCompliance.ContentSearch.Search.JobRunId	Security and compliance search job run ID.	String
O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime	Security and compliance search job run start time.	Date
O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime	Security and compliance search last modification time.	Date
O365.SecurityAndCompliance.ContentSearch.Search.LogLevel	Security and compliance search Azure log level.	String
O365.SecurityAndCompliance.ContentSearch.Search.Name	Security and compliance search name.	String
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation	Security and compliance search OneDrive locations to include.	String
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion	Security and compliance search OneDrive locations to exclude.	String
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation	Security and compliance search public folder locations to include.	String
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion	Security and compliance search public folder locations to exclude.	String
O365.SecurityAndCompliance.ContentSearch.Search.RunBy	Security and compliance search last run by UPN (Email representation).	String
O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId	Security and compliance search run space ID.	String
O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation	Security and compliance search SharePoint locations to include.	String
O365.SecurityAndCompliance.ContentSearch.Search.Size	Security and compliance search bytes results size.	Number
O365.SecurityAndCompliance.ContentSearch.Search.Status	Security and compliance search status.	String
O365.SecurityAndCompliance.ContentSearch.Search.TenantId	Security and compliance search Tenant ID.	String
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Location	Security and compliance search result location.	String
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.ItemsCount	The number of security and compliance search results in the location.	Number
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Size	The byte size of the security and compliance search results in the location.	Number
O365.SecurityAndCompliance.ContentSearch.SearchAction.Action	Security and compliance search action type. Either “Purge” or “Preview”.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled	Whether to include mailboxes other than regular user mailboxes in the compliance search.	Boolean
O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled	Whether the Azure Batch Framework is enabled for job processing.	Boolean
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId	Identity of a Core eDiscovery case which is associated with the compliance search.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName	Name of a Core eDiscovery case which is associated with the compliance search.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy	Security and compliance search action creator.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime	Security and compliance search action creation time.	Date
O365.SecurityAndCompliance.ContentSearch.SearchAction.Description	Security and compliance search action description.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors	Security and compliance search action errors.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId	Security and compliance search action job ID estimation.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId	Security and compliance search action run ID estimation.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation	Security and compliance search action exchange locations to include.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion	Security and compliance search action exchange locations to exclude.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity	Security and compliance search action identity.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid	Whether the security and compliance search action is valid.	Boolean
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime	Security and compliance search action job end time.	Date
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId	Security and compliance search action job ID.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId	Security and compliance search action job run ID.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime	Security and compliance search action job start time.	Date
O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime	Security and compliance search action last modified time.	Date
O365.SecurityAndCompliance.ContentSearch.SearchAction.Name	Security and compliance search action name.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation	Security and compliance search action public folder locations to include.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion	Security and compliance search action public folder locations to exclude.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Location	Security and compliance search action result location.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Sender	Security and compliance search action result mail sender.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Subject	Security and compliance search action result subject.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Type	Security and compliance search action result type.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Size	Security and compliance search action result size.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ReceivedTime	Security and compliance search action result received time.	Date
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.DataLink	Security and compliance search action data link.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry	Whether to retry if the search action failed.	Boolean
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy	Security and compliance search action run by UPN (email address).	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId	Security and compliance search action run space ID.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName	Security and compliance search action search name.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation	Security and compliance search action SharePoint locations to include.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion	Security and compliance search action SharePoint locations to exclude.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.Status	Security and compliance search action status. Either “Started” or “Completed”.	String
O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId	Security and compliance search action Tenant ID.	String

Playbook Image

Known Limitations

Each security and compliance command creates a PSSession (PowerShell session). The security and compliance PowerShell limits the number of concurrent sessions to 3. Since this affects the behavior of multiple playbooks running concurrently it we recommend that you retry failed tasks when using the integration commands in playbooks.
In order to handle sessions limits, A retry mechanism is applied which will retry for 10 time with 30 sec breaks. (The retry isn’t applied on the generic polling as it’s not supported yet)
Due to a Microsoft limitation, you can perform a search and purge operation on a maximum of 50,000 mailboxes. To work around this limitation, configure multiple instances of the integration each with different permission filtering so that the number of mailboxes in each instance does not exceed 50,000.

Inputs

search_name — The name of the compliance search.
force — If false, use the existing search without modifying any search parameters. If true, overwrite the existing search. Possible values are: "true" and "false".
preview — Whether to preview results using the search action. Possible values are: "true" and "false".
case — The name of a Core eDiscovery case to associate with the new compliance search.
kql — Text search string or a query that is formatted using the Keyword Query Language (KQL).
description — Description of the compliance search.
allow_not_found_exchange_locations — Whether to include mailboxes other than regular user mailboxes in the compliance search. Possible values are: "true" and "false".
exchange_location — Comma-separated list of mailboxes/distribution groups to include, or use the value "All" to include all.
exchange_location_exclusion — Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter.
public_folder_location — Comma-separated list of public folders to include, or use the value "All" to include all.
share_point_location — Comma-separated list of SharePoint online sites to include. You can identify the sites by their URL value, or use the value "All" to include all sites.
share_point_location_exclusion — Comma-separated list of SharePoint online sites to exclude when you use the value "All" for the share_point_location argument. You can identify the sites by their URL value.
polling_interval — Compliance search polling interval
polling_timeout — Compliance search polling timeout.

Outputs

O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled — Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled — Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.Search.CaseId — Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.CaseName — Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery — Compliance text search string or a query that is formatted using the Keyword Query Language (KQL).
O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy — Security and compliance search creator.
O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime — Security and compliance search creation time.
O365.SecurityAndCompliance.ContentSearch.Search.Description — Security and compliance search description.
O365.SecurityAndCompliance.ContentSearch.Search.Errors — Security and compliance search errors.
O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation — Security and compliance search exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Identity — Security and compliance search identity.
O365.SecurityAndCompliance.ContentSearch.Search.IsValid — Whether the security and compliance search is valid.
O365.SecurityAndCompliance.ContentSearch.Search.Items — Number of security and compliance search scanned items.
O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime — Security and compliance search job end time.
O365.SecurityAndCompliance.ContentSearch.Search.JobId — Security and compliance search job ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobRunId — Security and compliance search job run ID.
O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime — Security and compliance search job run start time.
O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime — Security and compliance search last modification time.
O365.SecurityAndCompliance.ContentSearch.Search.LogLevel — Security and compliance search Azure log level.
O365.SecurityAndCompliance.ContentSearch.Search.Name — Security and compliance search name.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation — Security and compliance search OneDrive locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion — Security and compliance search OneDrive locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation — Security and compliance search public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion — Security and compliance search public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.Search.RunBy — Security and compliance search last run by UPN (Email representation).
O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId — Security and compliance search run space ID.
O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation — Security and compliance search SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.Search.Size — Security and compliance search bytes results size.
O365.SecurityAndCompliance.ContentSearch.Search.Status — Security and compliance search status.
O365.SecurityAndCompliance.ContentSearch.Search.TenantId — Security and compliance search Tenant ID.
O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults — Security and compliance search results.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Action — Security and compliance search action type. Either "Purge" or "Preview".
O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled — Whether to include mailboxes other than regular user mailboxes in the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled — Whether the Azure Batch Framework is enabled for job processing.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId — Identity of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName — Name of a Core eDiscovery case which is associated with the compliance search.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy — Security and compliance search action creator.
O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime — Security and compliance search action creation time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Description — Security and compliance search action description.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors — Security and compliance search action errors.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId — Security and compliance search action job ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId — Security and compliance search action run ID estimation.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation — Security and compliance search action exchange locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion — Security and compliance search action exchange locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity — Security and compliance search action identity.
O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid — Whether the security and compliance search action is valid.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime — Security and compliance search action job end time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId — Security and compliance search action job ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId — Security and compliance search action job run ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime — Security and compliance search action job start time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime — Security and compliance search action last modified time.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Name — Security and compliance search action name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation — Security and compliance search action public folder locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion — Security and compliance search action public folder locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Results — Security and compliance search action results.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry — Whether to retry if the search action failed.
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy — Security and compliance search action run by UPN (email address).
O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId — Security and compliance search action run space ID.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName — Security and compliance search action search name.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation — Security and compliance search action SharePoint locations to include.
O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion — Security and compliance search action SharePoint locations to exclude.
O365.SecurityAndCompliance.ContentSearch.SearchAction.Status — Security and compliance search action status. Either "Started" or "Completed".
O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId — Security and compliance search action Tenant ID.

Commands used

o365-sc-get-search o365-sc-new-search o365-sc-remove-search o365-sc-start-search

Flowchart

Source

playbook-O365-SecurityAndCompliance-Search.yml playbook-O365-SecurityAndCompliance-SearchAction-Delete.yml playbook-O365-SecurityAndCompliance-SearchAction-Delete_README.md playbook-O365-SecurityAndCompliance-SearchAction-Preview.yml playbook-O365-SecurityAndCompliance-SearchAction-Preview_README.md playbook-O365-SecurityAndCompliance-SearchAndDelete.yml playbook-O365-SecurityAndCompliance-SearchAndDelete_README.md

Download History Raw

id: O365 - Security And Compliance - Search And Delete
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: O365 - Security And Compliance - Search And Delete
deprecated: true
description: |-
  Deprecated. Use the Microsoft Graph Security - Search And Delete Emails playbook instead.
  This playbook performs the following steps:
  1. Creates a compliance search.
  2. Starts a compliance search.
  3. Waits for the compliance search to complete.
  4. Gets the results of the compliance search.
  5. Gets the preview results, if specified.
  6. Deletes the search results (Hard/Soft).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a8ee8345-fbf4-4b8a-8181-5d444b413636
    type: start
    task:
      id: a8ee8345-fbf4-4b8a-8181-5d444b413636
      version: -1
      name: ""
      description: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 401e2d9a-11db-45ed-82e9-734db5db3ca8
    type: condition
    task:
      id: 401e2d9a-11db-45ed-82e9-734db5db3ca8
      version: -1
      name: Emails found?
      description: Checks if the search results exist. If not, no action should be performed.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults
            iscontext: true
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: f341c194-b500-4f99-8f3e-cd3885b51711
    type: title
    task:
      id: f341c194-b500-4f99-8f3e-cd3885b51711
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -990,
          "y": 2990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 326e36dd-d7cb-4001-85e4-061ec01226ef
    type: regular
    task:
      id: 326e36dd-d7cb-4001-85e4-061ec01226ef
      version: -1
      name: Remove search
      description: Remove the compliance search by name from the Security & Compliance Center.
      script: '|||o365-sc-remove-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      retry-count:
        simple: "10"
      search_name:
        complex:
          root: inputs.search_name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -980,
          "y": 2760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 413cef08-8ba6-43b8-8f51-aeb1ecf602f1
    type: regular
    task:
      id: 413cef08-8ba6-43b8-8f51-aeb1ecf602f1
      version: -1
      name: Remove search action
      description: Remove the compliance search action by searching for the action name in the Security & Compliance Center.
      script: '|||o365-sc-remove-search-action'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      retry-count:
        simple: "10"
      search_action_name:
        complex:
          root: O365.SecurityAndCompliance.ContentSearch.SearchAction
          accessor: Name
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -250,
          "y": 2680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: ee1c4f90-23cb-401e-8d09-e5d45bbdf8c2
    type: playbook
    task:
      id: ee1c4f90-23cb-401e-8d09-e5d45bbdf8c2
      version: -1
      name: O365 - Security And Compliance - Search
      description: |-
        This playbook performs the following steps:
        1. Creates a compliance search.
        2. Starts a compliance search.
        3. Waits for the compliance search to complete.
        4. Gets the results of the compliance search as an output.
        5. Gets the preview results, if specified.
      playbookName: O365 - Security And Compliance - Search
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      ' exchange_location_exclusion':
        complex:
          root: inputs.exchange_location_exclusion
      allow_not_found_exchange_locations:
        complex:
          root: inputs.allow_not_found_exchange_locations
      case:
        complex:
          root: inputs.case
      description:
        complex:
          root: inputs.description
      exchange_location:
        complex:
          root: ExchangeLocation
      force:
        complex:
          root: inputs.force
      kql:
        complex:
          root: inputs.kql
      polling_interval:
        simple: ${inputs.search_action_polling_interval}
      polling_timeout:
        simple: ${inputs.search_action_polling_timeout}
      preview:
        simple: "false"
      search_name:
        complex:
          root: inputs.search_name
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: 7ef52938-a049-4864-86c8-7a1fc43373d2
    type: condition
    task:
      id: 7ef52938-a049-4864-86c8-7a1fc43373d2
      version: -1
      name: Whether to preview the results.
      description: Whether to preview the results using the search action "Preview". Possible values are "true" and "false" or leave empty to select manually.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      Manual step - Preview:
      - "23"
      Preview:
      - "24"
      Skip:
      - "25"
    separatecontext: false
    conditions:
    - label: Preview
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.preview
                transformers:
                - operator: toUpperCase
            iscontext: true
          right:
            value:
              simple: "TRUE"
    - label: Manual step - Preview
      condition:
      - - operator: isEmpty
          left:
            value:
              complex:
                root: inputs.force
            iscontext: true
    - label: Skip
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.preview
                transformers:
                - operator: toUpperCase
            iscontext: true
          right:
            value:
              simple: "FALSE"
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: 089dc291-6f60-44db-807c-13e090115979
    type: condition
    task:
      id: 089dc291-6f60-44db-807c-13e090115979
      version: -1
      name: Manually select whether to preview the search results.
      description: Manual selection for the preview.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Preview:
      - "24"
      Skip:
      - "25"
    separatecontext: false
    defaultassigneecomplex:
      simple: admin
    view: |-
      {
        "position": {
          "x": 810,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: bd72040e-b521-4e2f-831c-c04cceaa84dd
    type: playbook
    task:
      id: bd72040e-b521-4e2f-831c-c04cceaa84dd
      version: -1
      name: O365 - Security And Compliance - Search Action - Preview
      description: |-
        This playbook performs the following steps:
        1. Creates a new compliance search action - Preview (Base on created compliance search).
        2. Waits for the preview action to complete.
        3. Retrieves the preview results.
      playbookName: O365 - Security And Compliance - Search Action - Preview
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      polling_interval:
        simple: ${inputs.search_action_polling_interval}
      polling_timeout:
        simple: ${inputs.search_action_polling_timeout}
      search_name:
        complex:
          root: O365.SecurityAndCompliance.ContentSearch.Search
          accessor: Name
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 810,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: 2aa70f15-3594-4832-829b-f3f398480518
    type: condition
    task:
      id: 2aa70f15-3594-4832-829b-f3f398480518
      version: -1
      name: Should the search action delete the results?
      description: Specify the delete type to perform on the search results. Possible values are "Hard" and "Soft" or leave empty to select manually. (Hard = Unrecoverable, Soft=Recoverable)
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      Hard:
      - "29"
      Manual step - delete:
      - "27"
      soft:
      - "28"
    separatecontext: false
    conditions:
    - label: Manual step - delete
      condition:
      - - operator: isEmpty
          left:
            value:
              complex:
                root: inputs.delete_type
            iscontext: true
    - label: soft
      condition:
      - - operator: inList
          left:
            value:
              complex:
                root: inputs.delete_type
                transformers:
                - operator: toUpperCase
            iscontext: true
          right:
            value:
              simple: SOFT
    - label: Hard
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.delete_type
                transformers:
                - operator: toUpperCase
            iscontext: true
          right:
            value:
              simple: HARD
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 1800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: eb4ae985-e3ae-4f50-8eca-acf94da282e1
    type: condition
    task:
      id: eb4ae985-e3ae-4f50-8eca-acf94da282e1
      version: -1
      name: Which type of delete do you want to perform?
      description: Manually select either Hard or Soft delete.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Hard:
      - "29"
      Skip:
      - "32"
      Soft:
      - "28"
    separatecontext: false
    defaultassigneecomplex:
      simple: admin
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: c5606169-c166-4c31-8072-203b88e3197b
    type: playbook
    task:
      id: c5606169-c166-4c31-8072-203b88e3197b
      version: -1
      name: O365 - Security And Compliance - Search Action - Delete
      description: |-
        This playbook performs the following steps:
        1. Creates a new compliance search action Purge - Hard or Soft.
        2. Waits for the compliance search action to complete.
        3. Retrieves the delete search action.
      playbookName: O365 - Security And Compliance - Search Action - Delete
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      delete_type:
        simple: Soft
      polling_interval:
        simple: ${inputs.search_action_polling_interval}
      polling_timeout:
        simple: ${inputs.search_action_polling_timeout}
      search_name:
        complex:
          root: O365.SecurityAndCompliance.ContentSearch.Search
          accessor: Name
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 730,
          "y": 2480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: c9aa0f2c-455e-4e63-88a2-9ccc4f31d547
    type: playbook
    task:
      id: c9aa0f2c-455e-4e63-88a2-9ccc4f31d547
      version: -1
      name: O365 - Security And Compliance - Search Action - Delete
      description: |-
        This playbook performs the following steps:
        1. Creates a new compliance search action Purge - Hard or Soft.
        2. Waits for the compliance search action to complete.
        3. Retrieves the delete search action.
      playbookName: O365 - Security And Compliance - Search Action - Delete
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      delete_type:
        simple: Hard
      polling_interval:
        simple: ${inputs.search_action_polling_interval}
      polling_timeout:
        simple: ${inputs.search_action_polling_timeout}
      search_name:
        complex:
          root: O365.SecurityAndCompliance.ContentSearch.Search
          accessor: Name
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 2470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 50e3fe8c-982b-4715-84f4-86b1aaec3adb
    type: regular
    task:
      id: 50e3fe8c-982b-4715-84f4-86b1aaec3adb
      version: -1
      name: Error - Preview parameter
      description: Print an error entry with a given message.
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      message:
        simple: Preview parameter should be empty or true or false.
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -340,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: 1a65115a-5733-4a90-8b9a-92863d644c57
    type: regular
    task:
      id: 1a65115a-5733-4a90-8b9a-92863d644c57
      version: -1
      name: Error - delete_type parameter
      description: Print an error entry with a given message.
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      message:
        simple: delete_type parameter should be empty or soft or hard delete.
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -320,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: 3799629e-3828-45ff-8ac6-76f91c2269af
    type: regular
    task:
      id: 3799629e-3828-45ff-8ac6-76f91c2269af
      version: -1
      name: Remove compliance search
      description: Remove the compliance search by name from the Security & Compliance Center.
      script: '|||o365-sc-remove-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      retry-count:
        simple: "10"
      search_name:
        complex:
          root: O365.SecurityAndCompliance.ContentSearch.Search
          accessor: Name
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 2470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: def40f3a-e3ba-496d-88af-39731e3d320b
    type: condition
    task:
      id: def40f3a-e3ba-496d-88af-39731e3d320b
      version: -1
      name: From where should emails be searched and deleted?
      description: Checks if a target to search and delete emails from was specified. Determined by the O365ExchangeLocation playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "35"
      User Input:
      - "36"
    separatecontext: false
    conditions:
    - label: User Input
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.exchange_location
            iscontext: true
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: b51ca904-5901-47db-8a6a-06cd5b6f31f1
    type: regular
    task:
      id: b51ca904-5901-47db-8a6a-06cd5b6f31f1
      version: -1
      name: Set all mailboxes to be searched
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      key:
        simple: ExchangeLocation
      value:
        simple: All
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -110,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 7bffe37a-56c1-4b6a-8f22-d93e811a3ce4
    type: regular
    task:
      id: 7bffe37a-56c1-4b6a-8f22-d93e811a3ce4
      version: -1
      name: Set the "email to" as the mailbox to search
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      key:
        simple: ExchangeLocation
      value:
        complex:
          root: inputs.exchange_location
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 400,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "22_23_Manual step - Preview": 0.49,
      "22_24_Preview": 0.27,
      "22_25_Skip": 0.31,
      "23_24_Preview": 0.51,
      "23_25_Skip": 0.21,
      "25_28_soft": 0.22,
      "25_29_Hard": 0.25,
      "27_28_Soft": 0.43,
      "27_29_Hard": 0.2,
      "27_32_Skip": 0.31,
      "33_35_#default#": 0.62,
      "33_36_User Input": 0.6
    },
    "paper": {
      "dimensions": {
        "height": 3015,
        "width": 2680,
        "x": -990,
        "y": 40
      }
    }
  }
inputs:
- key: search_name
  value: {}
  required: false
  description: The name of the compliance search.
  playbookInputQuery:
- key: case
  value: {}
  required: false
  description: The name of a Core eDiscovery case to associate with the new compliance search.
  playbookInputQuery:
- key: kql
  value: {}
  required: true
  description: Text search string or a query that is formatted using the Keyword Query Language (KQL).
  playbookInputQuery:
- key: description
  value: {}
  required: false
  description: Description of the compliance search.
  playbookInputQuery:
- key: allow_not_found_exchange_locations
  value:
    simple: "true"
  required: false
  description: Whether to include mailboxes other than regular user mailboxes in the compliance search. Default is "false".
  playbookInputQuery:
- key: exchange_location
  value: {}
  required: false
  description: Comma-separated list of mailboxes/distribution groups to include, or use the value "All" to include all.
  playbookInputQuery:
- key: exchange_location_exclusion
  value: {}
  required: false
  description: Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter.
  playbookInputQuery:
- key: force
  value:
    simple: "false"
  required: true
  description: Whether to replace the existing search. If "true", the existing search will be removed and a new search will be created. If "false", the existing search will be used and any new search configurations will be ignored.
  playbookInputQuery:
- key: preview
  value:
    simple: "true"
  required: true
  description: 'Whether to preview the results using the search action "Preview". Possible values are: "true" and "false" or leave empty to select manually.'
  playbookInputQuery:
- key: delete_type
  value: {}
  required: false
  description: Specify the delete type to perform on the search results. Possible values are Hard and Soft or leave empty to select manually. (Hard = Unrecoverable, Soft=Recoverable)
  playbookInputQuery:
- key: search_action_polling_timeout
  value:
    simple: "45"
  required: false
  description: Amount of time to poll before declaring a timeout for the search action and resuming the playbook (in minutes).
  playbookInputQuery:
- key: search_action_polling_interval
  value:
    simple: "3"
  required: false
  description: The frequency that the polling command will run for the search action that was chosen.
  playbookInputQuery:
outputs: []
tests:
- No tests (deprecated)
fromversion: 5.5.0
supportedModules:
- agentix
- cloud
- xsiam
- edr
- cloud_runtime_security