Search And Delete Emails - Microsoft Graph Security

This playbook performs the following steps: 1. Checks that the Microsoft Graph integration is available and active. 2. Lists existing eDiscovery cases and finds the specified case, or creates it if missing. 3. Composes the KQL content query based on the mailbox scope (recipientsOnly, allTenantMailboxes, or other). 4. Creates a new eDiscovery search with the composed query, or reuses an existing search based on the force input. 5. Runs an estimate statistics operation to count emails matching the query. 6. Waits for the estimate operation to complete and checks whether any emails were found. 7. Optionally previews the results (statistics summary or full export), based on the preview input. 8. Purges the matching emails (Hard delete / Soft delete / manual analyst approval). 9. Cleans up the eDiscovery search based on the cleanup input.

Microsoft Graph Security · 58 tasks · 13 inputs · 0 outputs

Inputs

  • case — eDiscovery case to use. Looked up by name; created if missing.
  • mailbox_scope — One of: recipientsOnly, allTenantMailboxes, allCaseCustodians, allCaseNoncustodialDataSources, allTenantSites. Drives data_source_scopes and KQL composition.
  • kql — KQL query identifying the emails to search/delete. Additional clauses are composed around it depending on mailbox_scope.
  • recipients — CSV of email addresses. Required when mailbox_scope=recipientsOnly. Optional when mailbox_scope=allCaseCustodians.
  • mailbox_exclusion — CSV of mailboxes to exclude. Honored only when mailbox_scope=allTenantMailboxes.
  • search_name — When provided, plays into the force semantics (force=true delete-and-recreate, force=false reuse). When omitted, an auto-name like XSOAR-Search-${incident.id}-${ts} is generated.
  • description — eDiscovery search description. Defaults to "Created by XSOAR for incident ${incident.id}" when empty.
  • force — Only meaningful when search_name is provided. true ⇒ delete-and-recreate. false ⇒ reuse existing.
  • preview — "true" / "false" / empty=manual. Whether to pause for analyst review before delete.
  • preview_mode — "statistics" (count + size from estimate) or "export" (run export job, download report).
  • export_format — File format for the export when preview_mode=export. "msg" produces individual .msg files inside a ZIP (preferred for analyst review). "pst" produces a single PST archive. Ignored when preview_mode=statistics.
  • delete_type — "Hard" / "Soft" / empty=manual (also lets analyst pick Skip).
  • cleanup — "auto" / "true" / "false". auto ⇒ delete the search only if it was auto-generated.

Commands used

msg-create-ediscovery-case msg-create-ediscovery-search msg-delete-ediscovery-search msg-export-result-ediscovery-data msg-get-last-estimate-statistics-operation msg-list-case-operation msg-list-ediscovery-cases msg-list-ediscovery-searchs msg-purge-ediscovery-data msg-run-estimate-statistics

Flowchart

yes Create new case Reuse existing case allTenantMailboxes recipientsOnly Exclusion not provided Exclusion provided Create new search Reuse existing search yes Delete existing search false export statistics #error# #error# hard manual soft #error# #error# auto delete hard soft #error# Email found Preview false manual Preview export false Generate new description Reuse existing description yes Start Start Check Microsoft Graph integration is available - IsIntegrationAvailable Check Microsoft Graph int... IsIntegrationAvailable Done Done List eDiscovery cases - msg-list-ediscovery-cases List eDiscovery cases msg-list-ediscovery-cases Does the specified eDiscovery case exist? Does the specified eDisco... Create eDiscovery case - msg-create-ediscovery-case Create eDiscovery case msg-create-ediscovery-case Route by mailbox scope Route by mailbox scope Build participants clause - Set Build participants clause Set Is a mailbox exclusion list provided? Is a mailbox exclusion li... Was a custom search name provided? Was a custom search name ... List eDiscovery searches in case - msg-list-ediscovery-searchs List eDiscovery searches ... msg-list-ediscovery-searchs Does a matching eDiscovery search already exist? Does a matching eDiscover... Re-create or reuse existing search? Re-create or reuse existi... Delete existing search - msg-delete-ediscovery-search Delete existing search msg-delete-ediscovery-search Retrieve search ID from existing search - Set Retrieve search ID from e... Set Create eDiscovery search - msg-create-ediscovery-search Create eDiscovery search msg-create-ediscovery-search Run estimate statistics - msg-run-estimate-statistics Run estimate statistics msg-run-estimate-statistics Should results be previewed before purging? Should results be preview... Display estimate statistics - Print Display estimate statistics Print Start export task - msg-export-result-ediscovery-data Start export task msg-export-result-ediscovery-... Download export file - msg-list-case-operation Download export file msg-list-case-operation How should the matched emails be purged? How should the matched em... Permanently delete matched emails - msg-purge-ediscovery-data Permanently delete matche... msg-purge-ediscovery-data Move matched emails to recoverable items - msg-purge-ediscovery-data Move matched emails to re... msg-purge-ediscovery-data Should the eDiscovery search be cleaned up? Should the eDiscovery sea... Delete eDiscovery search - msg-delete-ediscovery-search Delete eDiscovery search msg-delete-ediscovery-search Analyst: select purge type or skip Analyst: select purge typ... Wait for estimate statistics to complete - msg-get-last-estimate-statistics-operation Wait for estimate statist... msg-get-last-estimate-statist... Purge Emails Purge Emails Preview Results Preview Results Cleanup eDiscovery Search Cleanup eDiscovery Search Is any email found? Is any email found? Print no emails found - Print Print no emails found Print Finalize the email search query - Set Finalize the email search... Set Set scope: all tenant mailboxes (recipients filter) - Set Set scope: all tenant mai... Set Use provided KQL query as-is (no exclusion) - Set Use provided KQL query as... Set Build exclusion clause - Set Build exclusion clause Set Wrap KQL query for exclusion filtering - Set Wrap KQL query for exclus... Set Set DataSourceScopes - Set Set DataSourceScopes Set Set scope: all tenant mailboxes (no exclusion) - Set Set scope: all tenant mai... Set Use provided KQL query as-is (whole-tenant scope) - Set Use provided KQL query as... Set Set scope: custom mailbox scope from input - Set Set scope: custom mailbox... Set Store found case ID - Set Store found case ID Set Add recipients filter to KQL query - Set Add recipients filter to ... Set Add exclusion clause to KQL query - Set Add exclusion clause to K... Set Generate search name automatically - Set Generate search name auto... Set Which preview mode should be used? Which preview mode should... Analyst: confirm whether to preview found emails Analyst: confirm whether ... Save resolved search name - Set Save resolved search name Set Was a custom search description provided? Was a custom search descr... Generate default search description - Set Generate default search d... Set Save provided search description - Set Save provided search desc... Set Store newly created search ID - Set Store newly created searc... Set Store newly created case ID - Set Store newly created case ID Set Store found search ID - Set Store found search ID Set Notify: export results are not yet ready - Print Notify: export results ar... Print Run Search Statistics Run Search Statistics Was the search auto-generated? Was the search auto-gener...