category: Authentication & Identity Management
provider: Google
commonfields:
  id: google-vault
  version: -1
configuration:
- display: Username
  name: gsuite_credentials
  hiddenpassword: true
  required: true
  type: 9
  section: Connect
- display: Authentication file contents
  name: auth_json
  type: 4
  hidden: true
  required: false
  section: Connect
- name: auth_json_creds
  type: 9
  displaypassword: Authentication file contents
  hiddenusername: true
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: Archiving and eDiscovery for G Suite.
display: Google Vault
name: google-vault
script:
  commands:
  - arguments:
    - description: The matter ID.
      name: matterID
      required: true
    - description: Export Name.
      name: exportName
      required: true
    - auto: PREDEFINED
      defaultValue: All Data
      description: Search scope, default is "All Data"; "All Data", "Held Data", "Unprocessed Data".
      name: dataScope
      predefined:
      - All Data
      - Held Data
      - Unprocessed Data
    - auto: PREDEFINED
      defaultValue: All Accounts
      description: Search method, default is "All Accounts"; "All Accounts", "Specific Accounts" (requires the "email" argument), "Organizational Unit" (requires the "ou" argument).
      name: searchMethod
      predefined:
      - All Accounts
      - Specific Accounts(requires emails argument)
      - Organizational Unit(requires ou argument)
    - description: CSV list of emails to search in. Use this argument if the "searchMethod" argument is set to "Specific Accounts".
      name: emails
    - description: The organizational unit. Only use this argument if the "searchMethod" argument is set to "Organizational Unit".
      name: ou
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether to include drafts in the search, default is "true"; "true" or "false".
      name: includeDrafts
      predefined:
      - 'true'
      - 'false'
    - description: Search time frame, e.g., "1 min ago","2 weeks ago","3 months ago".
      name: timeFrame
    - description: Search start time in UTC (2018-10-16T12:59:02.584000Z).
      name: startTime
    - description: Search end time in UTC (2018-10-16T12:59:02.584000Z).
      name: endTime
    - description: Apply specific terms to the search, e.g., (subject:example).
      name: terms
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Export in PST format, default is "true"; "true" or "false".
      name: exportPST
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Export in MBOX format, default is "false"; "true" or "false".
      name: exportMBOX
      predefined:
      - 'true'
      - 'false'
    description: Creates a Google Vault export in order to perform search actions on emails.
    name: gvault-create-export-mail
    outputs:
    - contextPath: GoogleVault.Matter.Export.MatterID
      description: Matter ID.
      type: string
    - contextPath: GoogleVault.Matter.Export.ExportID
      description: Export ID.
      type: string
    - contextPath: GoogleVault.Matter.Export.Name
      description: Export's name.
      type: string
    - contextPath: GoogleVault.Matter.Export.CreateTime
      description: Export's creation time.
      type: string
  - arguments:
    - description: A name for the new matter.
      name: name
      required: true
    - description: A description for the matter.
      name: description
    description: Creates a new matter with the specified name and description. The initial state is open, and the owner is the method caller. First, checks if a matter with the same name already exists.
    name: gvault-create-matter
    outputs:
    - contextPath: GoogleVault.Matter.Name
      description: Matter name.
      type: string
    - contextPath: GoogleVault.Matter.ID
      description: Matter ID.
      type: string
    - contextPath: GoogleVault.Matter.State
      description: Matter's state.
      type: string
  - arguments:
    - description: Matter ID.
      name: matterID
      required: true
    - description: Export Name.
      name: exportName
      required: true
    - auto: PREDEFINED
      defaultValue: All Data
      description: Search scope, default is "All Data"; "All Data", "Held Data", "Unprocessed Data".
      name: dataScope
      predefined:
      - All Data
      - Held Data
      - Unprocessed Data
    - auto: PREDEFINED
      defaultValue: Specific Accounts(requires emails argument)
      description: Search method, default is "Specific Accounts"; "Specific Accounts" (requires the "email" argument), "Organizational Unit" (requires the "ou" argument), "Team Drive".
      name: searchMethod
      predefined:
      - Specific Accounts(requires emails argument)
      - Organizational Unit(requires ou argument)
      - Team Drive
    - description: CSV list of emails to search in. Use this argument if the "searchMethod" argument is set to "Specific Accounts".
      name: emails
    - description: The organizational unit. Only use this argument if the "searchMethod" argument is set to "Organizational Unit".
      name: ou
    - description: If the searchMethod is set to Team Drives.
      name: teamDrive
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether to include team drives, default is "true"; "true" or "false".
      name: includeTeamDrives
      predefined:
      - 'true'
      - 'false'
    - description: Search time frame.
      name: timeFrame
    - description: Search start time in UTC (2018-10-16T12:59:02.584000Z).
      name: startTime
    - description: Search end time in UTC (2018-10-16T12:59:02.584000Z).
      name: endTime
    - description: Apply specific terms to the search.
      name: terms
    description: Creates a Google Vault export in order to perform search actions on drives.
    name: gvault-create-export-drive
    outputs:
    - contextPath: GoogleVault.Matter.Export.MatterID
      description: Matter ID.
      type: string
    - contextPath: GoogleVault.Matter.Export.ExportID
      description: Export ID.
      type: string
    - contextPath: GoogleVault.Matter.Export.Name
      description: Export's name.
      type: string
    - contextPath: GoogleVault.Matter.Export.CreateTime
      description: Export's creation time.
      type: string
  - arguments:
    - description: The matter ID.
      name: matterID
      required: true
    - auto: PREDEFINED
      description: New matter state; "CLOSE", "DELETE", "REOPEN", "UNDELETE".
      name: state
      predefined:
      - CLOSE
      - DELETE
      - REOPEN
      - UNDELETE
      required: true
    description: Matter's updated state.
    name: gvault-matter-update-state
    outputs:
    - contextPath: GoogleVault.Matter.Name
      description: Matter name.
      type: string
    - contextPath: GoogleVault.Matter.MatterID
      description: Matter ID.
      type: string
    - contextPath: GoogleVault.Matter.State
      description: Matter's state.
      type: string
  - arguments:
    - description: The matter ID.
      name: matterID
      required: true
    - description: Export name.
      name: exportName
      required: true
    - auto: PREDEFINED
      defaultValue: All Data
      description: Search scope, default is "All Data"; "All Data", "Held Data", "Unprocessed Data".
      name: dataScope
      predefined:
      - All Data
      - Held Data
      - Unprocessed Data
    - description: CSV list of groups, maximum of 50 groups.
      name: groups
      required: true
    - description: Search time frame.
      name: timeFrame
    - description: Search start time in UTC (2018-10-16T12:59:02.584000Z).
      name: startTime
    - description: Search end time in UTC (2018-10-16T12:59:02.584000Z).
      name: endTime
    - description: Apply specific terms to the search.
      name: terms
    - auto: PREDEFINED
      default: true
      defaultValue: 'true'
      description: Export in PST format, default is "true"; "true" or "false".
      name: exportPST
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Export in MBOX format, default is "false"; "true" or "false".
      name: exportMBOX
      predefined:
      - 'true'
      - 'false'
    description: Creates a Google Vault Export in order to perform search actions on Google groups.
    name: gvault-create-export-groups
    outputs:
    - contextPath: GoogleVault.Matter.Export.MatterID
      description: Matter ID.
      type: string
    - contextPath: GoogleVault.Matter.Export.ExportID
      description: Export ID.
      type: string
    - contextPath: GoogleVault.Matter.Export.Name
      description: Export's name.
      type: string
    - contextPath: GoogleVault.Matter.Export.CreateTime
      description: Export's creation time.
      type: string
  - arguments:
    - description: The matter ID.
      name: matterID
      required: true
    - description: Name of the new hold.
      name: holdName
      required: true
    - auto: PREDEFINED
      description: New hold's corpus type; "Mail", "Drive", "Groups".
      name: corpus
      predefined:
      - Mail
      - Drive
      - Groups
      required: true
    - description: CSV list of accounts/group IDs to place in the hold, requires at least one account/group ID.
      isArray: true
      name: accountID
      required: true
    - description: Search timeframe.
      name: timeFrame
    - description: Search start time in UTC (1994-11-05T13:15:30Z ).
      name: startTime
    - description: Search end time in UTC (1994-11-05T13:15:30Z ).
      name: endTime
    - description: The terms that must be matched for a message to be covered by this hold.
      name: terms
    description: Creates a hold in the given matter. Holds are used to preserve data in the organization.
    name: gvault-create-hold
    outputs:
    - contextPath: GoogleVaulty.Hold.Name
      description: Hold name.
      type: string
    - contextPath: GoogleVault.Hold.ID
      description: Hold ID.
      type: string
    - contextPath: GoogleVault.Hold.Account.ID
      description: Held account ID.
      type: string
  - arguments:
    - description: The matter ID.
      name: matterID
      required: true
    - description: The hold ID.
      name: holdID
      required: true
    - description: The account/group ID to place in hold.
      name: accountID
      required: true
    description: Adds a Held Account to a hold. This structure is immutable.
    name: gvault-add-heldAccount
    outputs:
    - contextPath: GoogleVault.Matter.Hold.Account.ID
      description: The held account ID.
      type: Unknown
  - arguments:
    - description: The matter ID.
      name: matterID
      required: true
    - description: The hold ID.
      name: holdID
      required: true
    - description: Account ID to remove from hold.
      name: accountID
      required: true
    description: Removes a Held Account from a hold.
    name: gvault-remove-heldAccount
  - arguments:
    - description: The matter ID.
      name: matterID
      required: true
    - description: The hold ID.
      name: holdID
      required: true
    description: Removes a hold by ID. This will release any Held Accounts on this Hold.
    name: gvault-delete-hold
  - arguments:
    - auto: PREDEFINED
      defaultValue: All
      description: If set, list only matters with that specific state, default is "ALL"; "ALL", "OPEN", "CLOSED", "DELETED".
      name: state
      predefined:
      - All
      - Open
      - Closed
      - Deleted
    description: Lists matters the user has access to.
    name: gvault-list-matters
    outputs:
    - contextPath: GoogleVault.Matter.Name
      description: The matter name.
      type: string
    - contextPath: GoogleVault.Matter.MatterID
      description: Matter ID.
      type: string
    - contextPath: GoogleVault.Matter.State
      description: Matter's state.
      type: string
  - arguments:
    - description: Search by matter name (multiple matters with the same name can exist).
      name: matterName
    - description: Search by matter ID.
      name: matterID
    description: Search for a matter by name or by ID.
    name: gvault-get-matter
    outputs:
    - contextPath: GoogleVault.Matter.Name
      description: Matter name.
      type: Unknown
    - contextPath: GoogleVault.Matter.ID
      description: Matter ID.
      type: Unknown
    - contextPath: GoogleVault.Matter.State
      description: Matter's state.
      type: Unknown
  - arguments:
    - description: Matter ID.
      name: matterID
    description: Lists all holds for a specified matter.
    name: gvault-list-holds
    outputs:
    - contextPath: GoogleVault.Matter.ID
      description: Matter ID.
      type: string
    - contextPath: GoogleVault.Matter.Hold.name
      description: Hold name.
      type: string
    - contextPath: GoogleVault.Matter.Hold.ID
      description: Hold ID.
      type: string
  - arguments:
    - description: The matter ID.
      name: matterId
    - description: CSV list of one or more export IDs.
      isArray: true
      name: exportIDS
    - description: 'MatterID and ExportID concatenation separated by ''#'' (used only for playbook) such: <Matter_ID>#<ExportID>.'
      name: queryIDS
    description: Gets the status of one or more specified exports.
    name: gvault-export-status
    outputs:
    - contextPath: GoogleVault.Matter.Export.MatterID
      description: Matter ID.
      type: string
    - contextPath: GoogleVault.Matter.Export.ExportID
      description: Export ID.
      type: string
    - contextPath: GoogleVault.Matter.Export.Name
      description: Export name.
      type: string
    - contextPath: GoogleVault.Matter.Export.Status
      description: Export status.
      type: string
    - contextPath: GoogleVault.Matter.Export.BucketName
      description: Bucket holder name for this export.
      type: string
    - contextPath: GoogleVault.Matter.Export.DownloadID
      description: ID to be used by the "download-export" command.
      type: string
    - contextPath: GoogleVault.Matter.Export.ViewID
      description: ID to be used by the "get-X-results" command (X=drive/mail/groups).
      type: string
  - arguments:
    - description: Name of the bucket that holds the export.
      name: bucketName
      required: true
    - description: The export download ID.
      name: downloadID
      required: true
    description: Downloads an export by bucket name and download ID.
    name: gvault-download-results
  - arguments:
    - description: Name of the bucket that holds the export.
      name: bucketName
      required: true
    - description: The export view ID.
      name: viewID
      required: true
    - default: true
      defaultValue: '30'
      description: Maximum number of results to return (a high threshold can slow down your browser), default is "30".
      name: maxResult
    description: Get the results of a specified drive export.
    name: gvault-get-drive-results
    outputs:
    - contextPath: GoogleVault.Matter.Export.Results.Title
      description: Title of the file.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.Author
      description: Author of the file.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.Others
      description: Other users related to the file.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.Viewers
      description: Viewers of the file.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.DateModified
      description: The date the file was last modified.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.DateCreated
      description: The date the file was created.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.DocType
      description: File type (extension).
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.MD5
      description: The MD5 of the file (SHA-1).
      type: string
  - arguments:
    - description: Name of the bucket that holds the export.
      name: bucketName
      required: true
    - description: The export view ID.
      name: viewID
      required: true
    - default: true
      defaultValue: '30'
      description: Maximum number of results to return (a high threshold can slow down your browser), default is "30".
      name: maxResult
    description: Get the results of a specified mail export.
    name: gvault-get-mail-results
    outputs:
    - contextPath: GoogleVault.Matter.Export.Results.CC
      description: Email addresses CCed on the mail.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.BCC
      description: Email addresses BCCed on the mail.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.DateSent
      description: The date the email was sent.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.From
      description: The sender of the email.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.Subject
      description: The subject of the email.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.DateReceived
      description: The date the email was received.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.To
      description: The address the email was sent to.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.Account
      description: The account.
      type: string
  - arguments:
    - description: Name of the bucket that holds the export.
      name: bucketName
      required: true
    - description: The export view ID.
      name: viewID
      required: true
    - default: true
      defaultValue: '30'
      description: Maximum number of results to return (a high threshold can slow down your browser), default is "30".
      name: maxResult
    description: Get the results of a specified group export.
    name: gvault-get-groups-results
    outputs:
    - contextPath: GoogleVault.Matter.Export.Results.CC
      description: Email addresses CCed on the message.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.BCC
      description: Email addresses BCCed on the message.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.DateSent
      description: The date the message was sent.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.From
      description: The sender of the message.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.Subject
      description: The subject of the message.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.DateReceived
      description: The date the message was received.
      type: string
    - contextPath: GoogleVault.Matter.Export.Results.To
      description: The address the message was sent to.
      type: string
  dockerimage: demisto/googleapi-python3:1.0.0.10182333
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Google-Vault-Generic-Test
fromversion: 5.0.0
sectionorder:
- Connect
- Collect