category: Analytics & SIEM
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Microsoft Graph
  version: -1
configuration:
- defaultvalue: Worldwide
  display: Azure Cloud
  name: azure_cloud
  required: false
  type: 15
  options:
  - Worldwide
  - US GCC
  - US GCC-High
  - DoD
  - Germany
  - China
  - Custom
  additionalinfo: When selecting the Custom option, the Host URL parameter must be filled. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud
  section: Connect
  advanced: true
- display: Host URL
  name: host
  required: false
  type: 0
  section: Connect
  advanced: true
  additionalinfo: The host URL. When using this parameter, select the Custom option for the Azure Cloud. More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud
- name: creds_auth_id
  type: 9
  section: Connect
  displaypassword: Application ID or Client ID
  hiddenusername: true
  required: false
- name: creds_tenant_id
  type: 9
  section: Connect
  displaypassword: Token or Tenant ID
  hiddenusername: true
  required: false
- name: creds_enc_key
  type: 9
  section: Connect
  displaypassword: Key or Client Secret
  hiddenusername: true
  required: false
- additionalinfo: See the Help tab.
  display: Application ID or Client ID
  name: auth_id
  type: 4
  section: Connect
  hidden: true
  required: false
- additionalinfo: See the Help tab.
  display: Token or Tenant ID
  name: tenant_id
  type: 4
  section: Connect
  hidden: true
  required: false
- display: Key or Client Secret
  name: enc_key
  type: 4
  section: Connect
  additionalinfo: See the Help tab.
  hidden: true
  required: false
- display: Certificate Thumbprint
  name: creds_certificate
  type: 9
  section: Connect
  displaypassword: Private Key
  required: false
- display: Certificate Thumbprint
  name: certificate_thumbprint
  type: 4
  section: Connect
  additionalinfo: Used for certificate authentication as it appears in the "Certificates & secrets" page of the app.
  hidden: true
  required: false
- display: Private Key
  name: private_key
  type: 14
  section: Connect
  additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  hidden: true
  required: false
- display: Application redirect URI (for self-deployed mode)
  name: redirect_uri
  type: 0
  section: Connect
  required: false
- additionalinfo: Get the authorization code from steps 3-5 in the self deployed authorization process.
  displaypassword: Authorization code
  name: auth_code
  hiddenusername: true
  type: 9
  section: Connect
  required: false
  display: Authorization code
- display: Use Azure Managed Identities
  name: use_managed_identities
  type: 8
  section: Connect
  required: false
  additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.
- name: managed_identities_client_id
  type: 9
  section: Connect
  required: false
  additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  hiddenusername: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
  advanced: true
- display: Use a self-deployed Azure application
  name: self_deployed
  type: 8
  section: Connect
  required: false
  additionalinfo: Select this checkbox if you are using a self-deployed Azure application.
  advanced: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents type
  name: fetch_incidents_type
  type: 16
  section: Collect
  required: false
  defaultvalue: Alerts
  additionalinfo: Select which record types to fetch. You can select Alerts, Incidents, or both.
  options:
  - Alerts
  - Incidents
  supportedModules:
  - agentix
  - xsiam
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  additionalinfo: <number> <time unit>, for example 1 hour, 30 minutes
  name: fetch_time
  type: 0
  section: Collect
  required: false
  defaultvalue: 3 days
- display: Fetch limit per type
  additionalinfo: The maximum number of items to fetch per type. Applies to both alerts and incidents. Note that when fetching incidents, no more than 50 can be fetched per cycle, due to a Microsoft limitation.
  name: fetch_limit
  type: 0
  section: Collect
  required: false
  defaultvalue: '50'
- display: Alerts Service Sources
  additionalinfo: Relevant only when fetching alerts. A comma-separated list of service sources, for example, "microsoftDefenderForEndpoint,microsoftDefenderForIdentity". If empty, alerts from all service sources will be fetched.
  name: fetch_service_sources
  type: 0
  section: Collect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Alerts Filter
  additionalinfo: Filters fetched alerts according to their properties. Relevant only when fetching alerts. Overrides the service sources list, if provided. The filter format must be {property} eq '{property-value}'. Multiple filters can be separated by " and ", for example, "createdDateTime eq YYYY-MM-DD and severity eq 'high'".
  name: fetch_filter
  type: 0
  section: Collect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Filter
  additionalinfo: Filters fetched incidents according to their properties. Relevant only when fetching incidents. The filter format must be {property} eq '{property-value}'. Multiple filters can be separated by " and ", for example, "severity eq 'high' and status eq 'active'".
  name: fetch_incidents_filter
  type: 0
  section: Collect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Microsoft 365 Defender context
  name: microsoft_365_defender_context
  defaultvalue: "false"
  type: 8
  required: false
  additionalinfo: When selected, the hunting query result is also saved to the Microsoft 365 Defender context path. Relevant only for the msg-advanced-hunting command.
  section: Collect
description: Unified gateway to security insights - all from a unified Microsoft Graph Security API.
display: Microsoft Graph Security
name: Microsoft Graph
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: When the alert was last modified in the following string format - YYYY-MM-DD.
      name: last_modified
      predefined:
      - Last24Hours
      - Last48Hours
      - LastWeek
    - auto: PREDEFINED
      description: Alert severity - set by vendor/provider.
      name: severity
      predefined:
      - unknown
      - informational
      - low
      - medium
      - high
    - description: Category of the alert, e.g. credentialTheft, ransomware (Categories can be added or removed by vendors.)
      name: category
    - description: The start time (creation time of alert) for the search in the following string format - YYYY-MM-DD.
      name: time_from
    - description: The end time (creation time of alert) for the search in the following string format -  YYYY-MM-DD.
      name: time_to
    - description: Use this field to filter on any of the alert properties in the format "{property} eq '{property-value}'", e.g. "category eq 'ransomware'".
      name: filter
    - auto: PREDEFINED
      description: Use this field to filter by an alert's classification.
      name: classification
      predefined:
      - unknown
      - truePositive
      - falsePositive
      - benignPositive
    - auto: PREDEFINED
      description: Use this field to filter the alerts by the service or product that created this alert.
      name: service_source
      predefined:
      - microsoftDefenderForEndpoint
      - microsoftDefenderForIdentity
      - microsoftDefenderForOffice365
      - microsoft365Defender
      - microsoftAppGovernance
      - microsoftDefenderForCloudApps
    - auto: PREDEFINED
      description: Use this field to filter by alert's status.
      name: status
      predefined:
      - unknown
      - new
      - inProgress
      - resolved
    - description: Page number to return, zero indexed.
      name: page
    - description: Number of results in a page. Default is 50. The limit is 2000.
      name: page_size
    - description: Number of total results to return. Default is 50.
      name: limit
      defaultValue: 50
    description: Get a list of alerts (security issues) within a customer's tenant that Microsoft or partner security solutions have identified.
    name: msg-search-alerts
    outputs:
    - contextPath: MsGraph.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: MsGraph.Alert.Title
      description: Alert title.
      type: string
    - contextPath: MsGraph.Alert.Category
      description: Alert category.
      type: string
    - contextPath: MsGraph.Alert.Severity
      description: Alert severity.
      type: string
    - contextPath: MsGraph.Alert.CreatedDate
      description: Alert created date.
      type: date
    - contextPath: MsGraph.Alert.Status
      description: Alert status.
      type: string
    - contextPath: MsGraph.Alert.ActorDisplayName
      description: Alert actor name.
      type: Unknown
    - contextPath: MsGraph.Alert.AlertWebUrl
      description: Alert web URL.
      type: String
    - contextPath: MsGraph.Alert.AssignedTo
      description: Alert assignee.
      type: Unknown
    - contextPath: MsGraph.Alert.Classification
      description: Alert classification.
      type: Unknown
    - contextPath: MsGraph.Alert.Description
      description: Alert description.
      type: String
    - contextPath: MsGraph.Alert.DetectionSource
      description: Alert detection source.
      type: String
    - contextPath: MsGraph.Alert.DetectorId
      description: Alert detector ID.
      type: String
    - contextPath: MsGraph.Alert.Determination
      description: Alert determination.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.@odata.Type
      description: Alert evidence type.
      type: String
    - contextPath: MsGraph.Alert.Evidence.AzureAdDeviceId
      description: Evidence azure device ID.
      type: String
    - contextPath: MsGraph.Alert.Evidence.CreatedDate
      description: Evidence creation time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.DefenderAvStatus
      description: Evidence Defender AV status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.DeviceDnsName
      description: Evidence device DNS name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FirstSeenDateTime
      description: Evidence first seen time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.HealthStatus
      description: Evidence health status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.MdeDeviceId
      description: Evidence MDE device ID.
      type: String
    - contextPath: MsGraph.Alert.Evidence.OnboardingStatus
      description: Evidence onboarding status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.OsBuild
      description: Evidence OS build.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.OsPlatform
      description: Evidence OS platform.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RbacGroupId
      description: Evidence RBAC group ID.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.RbacGroupName
      description: Evidence RBAC group name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RemediationStatus
      description: Evidence remediation status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RemediationStatusDetails
      description: Evidence remediation status details.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.RiskScore
      description: Evidence risk score.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Tags
      description: Evidence tags.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Verdict
      description: Evidence verdict.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Version
      description: Evidence version.
      type: String
    - contextPath: MsGraph.Alert.Evidence.VmMetadata
      description: Evidence VM metadata.
      type: Unknown
    - contextPath: MsGraph.Alert.FirstActivityDateTime
      description: Evidence first activity time.
      type: Date
    - contextPath: MsGraph.Alert.IncidentId
      description: Alert incident ID.
      type: String
    - contextPath: MsGraph.Alert.IncidentWebUrl
      description: Alert incident URL.
      type: String
    - contextPath: MsGraph.Alert.LastActivityDateTime
      description: Alert last activity time.
      type: Date
    - contextPath: MsGraph.Alert.LastUpdateDateTime
      description: Alert last update time.
      type: Date
    - contextPath: MsGraph.Alert.ProviderAlertId
      description: Alert provider ID.
      type: String
    - contextPath: MsGraph.Alert.RecommendedActions
      description: Alert recommended action.
      type: String
    - contextPath: MsGraph.Alert.ResolvedDateTime
      description: Alert closing time.
      type: Date
    - contextPath: MsGraph.Alert.ServiceSource
      description: Alert service source.
      type: String
    - contextPath: MsGraph.Alert.TenantId
      description: Alert tenant ID.
      type: String
    - contextPath: MsGraph.Alert.ThreatDisplayName
      description: Alert threat display name.
      type: Unknown
    - contextPath: MsGraph.Alert.ThreatFamilyName
      description: Alert threat family name.
      type: Unknown
  - arguments:
    - default: true
      description: The Alert ID - Provider-generated GUID/unique identifier.
      name: alert_id
      required: true
    - defaultValue: All
      description: 'Deprecated. Was used for Legacy Alerts only.'
      name: fields_to_include
      hidden: true
      deprecated: true
    description: Get details for a specific alert.
    name: msg-get-alert-details
    outputs:
    - contextPath: MsGraph.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: MsGraph.Alert.Title
      description: Alert title.
      type: string
    - contextPath: MsGraph.Alert.Category
      description: Alert category.
      type: string
    - contextPath: MsGraph.Alert.Severity
      description: Alert severity.
      type: string
    - contextPath: MsGraph.Alert.CreatedDate
      description: Alert created date.
      type: date
    - contextPath: MsGraph.Alert.Status
      description: Alert status.
      type: string
    - contextPath: MsGraph.Alert.@odata.Context
      description: Alert odata context.
      type: String
    - contextPath: MsGraph.Alert.ActorDisplayName
      description: Alert actor name.
      type: Unknown
    - contextPath: MsGraph.Alert.AlertWebUrl
      description: Alert web URL.
      type: String
    - contextPath: MsGraph.Alert.AssignedTo
      description: Alert assignee.
      type: Unknown
    - contextPath: MsGraph.Alert.Classification
      description: Alert classification.
      type: Unknown
    - contextPath: MsGraph.Alert.Comments.Comment
      description: Alert comment.
      type: String
    - contextPath: MsGraph.Alert.Comments.CreatedByDisplayName
      description: Alert comment creator name.
      type: String
    - contextPath: MsGraph.Alert.Comments.CreatedDate
      description: Alert comment creation time.
      type: Date
    - contextPath: MsGraph.Alert.Description
      description: Alert description.
      type: String
    - contextPath: MsGraph.Alert.DetectionSource
      description: Alert detection source.
      type: String
    - contextPath: MsGraph.Alert.DetectorId
      description: Alert detector ID.
      type: String
    - contextPath: MsGraph.Alert.Determination
      description: Alert determination.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.@odata.Type
      description: Alert evidence.
      type: String
    - contextPath: MsGraph.Alert.Evidence.CreatedDate
      description: Evidence creation time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.DetectionStatus
      description: Evidence detection status.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ImageFile.FileName
      description: Evidence image file name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ImageFile.FilePath
      description: Evidence image file path.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ImageFile.FilePublisher
      description: Evidence image file publisher.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ImageFile.FileSize
      description: Evidence image file size.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ImageFile.Issuer
      description: Evidence image file issuer.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ImageFile.Sha1
      description: Evidence image file SHA1 hash.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ImageFile.Sha256
      description: Evidence image file SHA256 hash.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ImageFile.Signer
      description: Evidence image file signer.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.MdeDeviceId
      description: Evidence MDE device ID.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ParentProcessCreationDateTime
      description: Evidence parent process creation time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.ParentProcessId
      description: Evidence parent process process ID.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.ParentProcessImageFile
      description: Evidence parent process image file.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.ProcessCommandLine
      description: Evidence process command line.
      type: String
    - contextPath: MsGraph.Alert.Evidence.ProcessCreationDateTime
      description:  Evidence process creation time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.ProcessId
      description:  Evidence process ID.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.RemediationStatus
      description: Evidence remediation status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RemediationStatusDetails
      description: Evidence remediation status details.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.UserAccount.AccountName
      description: Evidence user account name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.UserAccount.AzureAdUserId
      description: Evidence user account Azure AD user ID.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.UserAccount.DisplayName
      description: Evidence user account display name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.UserAccount.DomainName
      description: Evidence user account domain name.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.UserAccount.UserPrincipalName
      description: Evidence user account user principal name.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.UserAccount.UserSid
      description: Evidence user account user SID.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Verdict
      description: Evidence verdict.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.FileName
      description: Evidence file details file name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.FilePath
      description: Evidence file details file path.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.FilePublisher
      description: Evidence file details file publisher.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.FileDetails.FileSize
      description: Evidence file details file size.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.FileDetails.Issuer
      description: Evidence file details file issuer.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.FileDetails.Sha1
      description: Evidence file details SHA1 hash.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.Sha256
      description: Evidence file details SHA256 hash.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FileDetails.Signer
      description: Evidence file details file signer.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.CֹountryLetterCode
      description: Evidence country letter code.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.IpAddress
      description: Evidence IP address.
      type: String
    - contextPath: MsGraph.Alert.Evidence.AzureAdDeviceId
      description: Evidence Azure AD device ID.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.DefenderAvStatus
      description: Evidence Defender AV status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.DeviceDnsName
      description: Evidence device DNS name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.FirstSeenDateTime
      description: Evidence first seen time.
      type: Date
    - contextPath: MsGraph.Alert.Evidence.HealthStatus
      description: Evidence health status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.OnboardingStatus
      description: Evidence onboarding status.
      type: String
    - contextPath: MsGraph.Alert.Evidence.OsBuild
      description: Evidence OS build.
      type: Unknown
    - contextPath: MsGraph.Alert.Evidence.OsPlatform
      description: Evidence OS platform.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RbacGroupId
      description: Evidence RBAC group ID.
      type: Number
    - contextPath: MsGraph.Alert.Evidence.RbacGroupName
      description: Evidence RBAC group name.
      type: String
    - contextPath: MsGraph.Alert.Evidence.RiskScore
      description: Evidence risk score.
      type: String
    - contextPath: MsGraph.Alert.Evidence.Version
      description: Evidence version.
      type: String
    - contextPath: MsGraph.Alert.Evidence.VmMetadata
      description: Evidence VM metadata.
      type: Unknown
    - contextPath: MsGraph.Alert.FirstActivityDateTime
      description: Evidence first activity time.
      type: Date
    - contextPath: MsGraph.Alert.IncidentId
      description: Alert incident ID.
      type: String
    - contextPath: MsGraph.Alert.IncidentWebUrl
      description: Alert incident URL.
      type: String
    - contextPath: MsGraph.Alert.LastActivityDateTime
      description: Alert last activity time.
      type: Date
    - contextPath: MsGraph.Alert.LastUpdateDateTime
      description: Alert last update time.
      type: Date
    - contextPath: MsGraph.Alert.ProviderAlertId
      description: Alert provider ID.
      type: String
    - contextPath: MsGraph.Alert.RecommendedActions
      description: Alert recommended action.
      type: String
    - contextPath: MsGraph.Alert.ResolvedDateTime
      description: Alert closing time.
      type: Date
    - contextPath: MsGraph.Alert.ServiceSource
      description: Alert service source.
      type: String
    - contextPath: MsGraph.Alert.TenantId
      description: Alert tenant ID.
      type: String
    - contextPath: MsGraph.Alert.ThreatDisplayName
      description: Alert threat display name.
      type: Unknown
    - contextPath: MsGraph.Alert.ThreatFamilyName
      description: Alert threat family name.
      type: Unknown
  - arguments:
    - description: The Alert ID. Provider-generated GUID/unique identifier.
      name: alert_id
      required: true
    - description: Name of the analyst the alert is assigned to for triage, investigation, or remediation.
      name: assigned_to
    - auto: PREDEFINED
      description: Alert lifecycle status (stage).
      name: status
      predefined:
      - unknown
      - newAlert
      - inProgress
      - resolved
    - description: Deprecated. Was used for Legacy Alerts only.
      name: closed_date_time
      hidden: true
      deprecated: true
    - description: Deprecated. Was used for Legacy Alerts only.
      name: comments
      hidden: true
      deprecated: true
    - auto: PREDEFINED
      description: Deprecated. Was used for Legacy Alerts only.
      name: feedback
      predefined:
      - unknown
      - truePositive
      - falsePositive
      - benignPositive
      hidden: true
      deprecated: true
    - description: Deprecated. Was used for Legacy Alerts only.
      name: tags
      hidden: true
      deprecated: true
    - description: Deprecated. Was used for Legacy Alerts only.
      name: vendor_information
      hidden: true
      deprecated: true
    - description: Deprecated. Was used for Legacy Alerts only.
      name: provider_information
      hidden: true
      deprecated: true
    - auto: PREDEFINED
      description: Use this field to update the alert's classification.
      name: classification
      predefined:
      - unknown
      - truePositive
      - falsePositive
      - informationalExpectedActivity
    - auto: PREDEFINED
      description: Use this field to update the alert's determination.
      name: determination
      predefined:
      - unknown
      - malware
      - phishing
      - other
      - securityTesting
      - multiStagedAttack
      - maliciousUserActivity
      - lineOfBusinessApplication
      - unwantedSoftware
    description: Update an editable alert property within any integrated solution to keep alert status and assignments in sync across solutions using its reference ID.
    name: msg-update-alert
    outputs:
    - contextPath: MsGraph.Alert.ID
      description: Alert ID.
      type: string
    - contextPath: MsGraph.Alert.Status
      description: Alert status, will appear only if changed.
      type: string
  - arguments:
    - default: true
      description: The alert ID - Provider-generated GUID/unique identifier.
      name: alert_id
      required: true
    - description: The comment to add to each alert.
      isArray: true
      name: comment
      required: true
      type: string
    description: Create a comment for an existing alert.
    name: msg-create-alert-comment
    outputs:
    - contextPath: MsGraph.AlertComment.ID
      description: The alert ID that the comment was added to.
      type: String
    - contextPath: MsGraph.AlertComment.Comments.Comment
      description: The comment itself.
      type: String
    - contextPath: MsGraph.AlertComment.Comments.CreatedByDisplayName
      description: The comment's creator display name.
      type: String
    - contextPath: MsGraph.AlertComment.Comments.CreatedDate
      description: The comment's creation time.
      type: Date
  - deprecated: true
    description: Deprecated. Use the Entra ID Users integration instead.
    name: msg-get-users
    outputs:
    - contextPath: MsGraph.User.Email
      description: User email address.
      type: string
    - contextPath: MsGraph.User.ID
      description: User ID.
      type: string
    - contextPath: MsGraph.User.Title
      description: User job title.
      type: string
    - contextPath: MsGraph.User.Name
      description: User name.
      type: string
  - arguments:
    - default: true
      description: User ID of user to retreive.
      name: user_id
      required: true
    deprecated: true
    description: Deprecated. Use the Entra ID Users integration instead.
    name: msg-get-user
    outputs:
    - contextPath: MsGraph.User.Email
      description: User email address.
      type: string
    - contextPath: MsGraph.User.ID
      description: User ID.
      type: string
    - contextPath: MsGraph.User.Title
      description: User job title.
      type: string
    - contextPath: MsGraph.User.Name
      description: User name.
      type: string
  - description: Run this command if for some reason you need to rerun the authentication process.
    execution: false
    name: ms-graph-security-auth-reset
    arguments: []
  - deprecated: false
    arguments:
    - description: Which permissions the integration should have.
      name: permission_type
      isArray: true
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'ediscovery'
      - 'alerts'
      - 'threat assessment'
      - 'all'
    description: Tests connectivity to Microsoft Graph Security.
    execution: false
    name: msg-auth-test
  - arguments: []
    description: Generate the login URL used for authorization code flow.
    execution: false
    name: msg-generate-login-url
  - arguments:
    - description: The name of the eDiscovery case.
      isArray: false
      name: display_name
      required: true
    - description: The case description.
      isArray: false
      name: description
      required: false
    - description: The external case number for customer reference.
      isArray: false
      name: external_id
      required: false
    description: Create a new eDiscovery case. This command only creates an eDiscovery (Premium) case using the new case format. To learn more about the new case format in eDiscovery, see https://learn.microsoft.com/en-us/microsoft-365/compliance/advanced-ediscovery-new-case-format.
    execution: false
    name: msg-create-ediscovery-case
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.CaseId
      description: The ID of the eDiscovery case.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.CaseStatus
      description: 'The case status. Possible values are: unknown, active, pendingDelete, closing, closed, and closedWithError.'
      type: String
    - contextPath: MsGraph.eDiscoveryCase.CreatedDateTime
      description: 'The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.Description
      description: The case description.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.DisplayName
      description: The case name.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.ExternalId
      description: The external case number for customer reference.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.LastModifiedDateTime
      description: 'The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    description: |-
      Close an eDiscovery case. When the legal case or investigation supported by a eDiscovery (Standard) case is completed, you can close the case. Here's what happens when you close a case:
      If the case contains any eDiscovery holds, they'll be turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This helps prevent content from being immediately deleted and provides admins the opportunity to search for and restore content before it may be permanently deleted after the delay hold period expires. For more information, see Removing content locations from an eDiscovery hold.
      Closing a case only turns off the holds that are associated with that case. If other holds are placed on a content location (such as a Litigation Hold, a retention policy, or a hold from a different eDiscovery (Standard) case) those holds will still be maintained.
      The case is still listed on the eDiscovery (Standard) page in the Microsoft Purview compliance portal. The details, holds, searches, and members of a closed case are retained.
      You can edit a case after it's closed. For example, you can add or remove members, create searches, and export search results. The primary difference between active and closed cases is that eDiscovery holds are turned off when a case is closed.
    execution: false
    name: msg-close-ediscovery-case
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    description: Reopen an eDiscovery case. When you reopen an eDiscovery (Premium) case, any holds that were in place when the case was closed won't be automatically reinstated. After the case is reopened, you'll have to go to the Holds tab and turn on the previous holds. To turn on a hold, select it to display the flyout page, and then set the Status toggle to On.
    execution: false
    name: msg-reopen-ediscovery-case
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    description: Delete an eDiscovery case. Before you can delete a case, you must first delete all holds listed on the holds page of the case. That includes deleting holds with a status of Off. Default hold policies can only be deleted when the hold is turned off. You must close an active case to turn off any default hold policies in the case. Once the holds are turned off for default hold policies, they can be deleted.
    execution: false
    name: msg-delete-ediscovery-case
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The name of the eDiscovery case.
      isArray: false
      name: display_name
      required: true
    - description: The case description.
      isArray: false
      name: description
      required: false
    - description: The external case number for customer reference.
      isArray: false
      name: external_id
      required: false
    description: Update an eDiscovery case.
    execution: false
    name: msg-update-ediscovery-case
  - arguments:
    - description: The ID of the eDiscovery case. If provided, only this ID will be returned.
      isArray: false
      name: case_id
      required: false
    - description: The maximum number of results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of the eDiscovery cases.
    execution: false
    name: msg-list-ediscovery-cases
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.CaseId
      description: The ID of the eDiscovery case.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.CaseStatus
      description: 'The case status. Possible values are: unknown, active, pendingDelete, closing, closed, and closedWithError.'
      type: String
    - contextPath: MsGraph.eDiscoveryCase.CreatedDateTime
      description: 'The date and time when the entity was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.Description
      description: The case description.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.DisplayName
      description: The case name.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.ExternalId
      description: The external case number for customer reference.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.LastModifiedDateTime
      description: 'The latest date and time when the case was modified. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.ClosedBy.User.DisplayName
      description: The user who closed the case.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.LastModifiedBy.User.DisplayName
      description: The user who last modified the case.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.ClosedDateTime
      description: 'The date and time when the case was closed. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.'
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: Custodian's primary SMTP address.
      isArray: false
      name: email
      required: true
    description: Create a new ediscoveryCustodian object. After the custodian object is created, you will need to create the custodian's userSource to reference their mailbox and OneDrive for Business site.
    execution: false
    name: msg-create-ediscovery-custodian
    outputs:
    - contextPath: MsGraph.eDiscoveryCustodian.CreatedDateTime
      description: Date and time when the custodian was added to the case.
      type: Date
    - contextPath: MsGraph.eDiscoveryCustodian.CustodianId
      description: The ID for the custodian in the specified case. Read-only.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.CustodianStatus
      description: 'Status of the custodian. Possible values are: active, released.'
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.DisplayName
      description: Display name of the custodian.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.Email
      description: Email address of the custodian.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.HoldStatus
      description: 'The hold status of the custodian.The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.LastModifiedDateTime
      description: Date and time the custodian object was last modified.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case. If provided, only this ID will be returned.
      isArray: false
      name: custodian_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of the custodians on a given eDiscovery case.
    execution: false
    name: msg-list-ediscovery-custodians
    outputs:
    - contextPath: MsGraph.eDiscoveryCustodian.CreatedDateTime
      description: Date and time when the custodian was added to the case.
      type: Date
    - contextPath: MsGraph.eDiscoveryCustodian.CustodianId
      description: The ID for the custodian in the specified case. Read-only.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.CustodianStatus
      description: 'Status of the custodian. Possible values are: active, released.'
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.DisplayName
      description: Display name of the custodian.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.Email
      description: Email address of the custodian.
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.HoldStatus
      description: 'The hold status of the custodian. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.eDiscoveryCustodian.LastModifiedDateTime
      description: Date and time the custodian object was last modified.
      type: Date
    - contextPath: MsGraph.eDiscoveryCustodian.ReleasedDateTime
      description: Date and time the custodian was released from the case.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    description: Release a custodian from a case. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/manage-new-custodians#release-a-custodian-from-a-case.
    execution: false
    name: msg-release-ediscovery-custodian
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    description: Activate a custodian that has been released from a case to make them part of the case again. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/ediscovery-manage-new-custodians?view=o365-worldwide#re-activate-custodian.
    execution: false
    name: msg-activate-ediscovery-custodian
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    - description: SMTP address of the user.
      isArray: false
      name: email
      required: true
    - description: Specifies which sources are included in this group.
      isArray: true
      name: included_sources
      required: true
      auto: PREDEFINED
      predefined:
      - mailbox
      - site
      - mailbox, site
    description: Create a new userSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
    execution: false
    name: msg-create-ediscovery-custodian-user-source
    outputs:
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.Application.DisplayName
      description: The name of the application who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.Application.ID
      description: The ID of the application who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.DisplayName
      description: The name of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.ID
      description: The ID of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedDateTime
      description: The date and time the userSource was created.
      type: Date
    - contextPath: MsGraph.CustodianUserSource.DisplayName
      description: The display name associated with the mailbox and site.
      type: String
    - contextPath: MsGraph.CustodianUserSource.Email
      description: Email address of the user's mailbox.
      type: String
    - contextPath: MsGraph.CustodianUserSource.HoldStatus
      description: 'The hold status of the userSource. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.CustodianUserSource.IncludedSources
      description: 'Specifies which sources are included in this group. Possible values are: mailbox, site.'
      type: String
    - contextPath: MsGraph.CustodianUserSource.UserSourceId
      description: The ID of the userSource. This is not the ID of the actual group.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    - description: URL of the site, for example, https://contoso.sharepoint.com/sites/HumanResources.
      isArray: false
      name: site
      required: true
    description: Create a new siteSource object associated with an eDiscovery custodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
    execution: false
    name: msg-create-ediscovery-custodian-site-source
    outputs:
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.Application.DisplayName
      description: The name of the application who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.Application.ID
      description: The ID of the application who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.DisplayName
      description: The name of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.ID
      description: The ID of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedDateTime
      description: The date and time the siteSource was created.
      type: Date
    - contextPath: MsGraph.CustodianSiteSource.DisplayName
      description: The display name of the siteSource. This will be the name of the SharePoint site.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.HoldStatus
      description: 'The hold status of the siteSource. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.CustodianSiteSource.SiteSourceId
      description: The ID of the siteSource.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    - description: The ID of the userSource. If provided, only this ID will be returned.
      isArray: false
      name: user_source_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of the userSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
    execution: false
    name: msg-list-ediscovery-custodian-user-sources
    outputs:
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.Application.DisplayName
      description: The name of the application who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.Application.ID
      description: The ID of the application who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.DisplayName
      description: The name of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.ID
      description: The ID of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the userSource.
      type: String
    - contextPath: MsGraph.CustodianUserSource.CreatedDateTime
      description: The date and time the userSource was created.
      type: Date
    - contextPath: MsGraph.CustodianUserSource.DisplayName
      description: The display name associated with the mailbox and site.
      type: String
    - contextPath: MsGraph.CustodianUserSource.Email
      description: Email address of the user's mailbox.
      type: String
    - contextPath: MsGraph.CustodianUserSource.HoldStatus
      description: 'The hold status of the userSource. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.CustodianUserSource.IncludedSources
      description: 'Specifies which sources are included in this group. Possible values are: mailbox, site.'
      type: String
    - contextPath: MsGraph.CustodianUserSource.SiteWebUrl
      description: The URL of the user's OneDrive for Business site. Read-only.
      type: String
    - contextPath: MsGraph.CustodianUserSource.UserSourceId
      description: The ID of the userSource. This is not the ID of the actual group.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the custodian on the given eDiscovery case.
      isArray: false
      name: custodian_id
      required: true
    - description: The ID of the siteSource. If provided, only this ID will be returned.
      isArray: false
      name: site_source_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of the siteSource objects associated with an eDiscoveryCustodian. Use the msg-list-ediscovery-custodians command in order to get all available custodians.
    execution: false
    name: msg-list-ediscovery-custodian-site-sources
    outputs:
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.Application.DisplayName
      description: The name of the application who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.Application.ID
      description: The ID of the application who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.DisplayName
      description: The name of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.ID
      description: The ID of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.CreatedDateTime
      description: The date and time the siteSource was created.
      type: Date
    - contextPath: MsGraph.CustodianSiteSource.DisplayName
      description: The display name of the siteSource. This will be the name of the SharePoint site.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.HoldStatus
      description: 'The hold status of the siteSource. The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.CustodianSiteSource.SiteSourceId
      description: The ID of the siteSource.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.Site.ID
      description: The unique identifier of the item. Read-only.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.Site.WebUrl
      description: URL that displays the item in the browser. Read-only.
      type: String
    - contextPath: MsGraph.CustodianSiteSource.Site.CreatedDate
      description: The date and time the siteSource was created.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: URL of the site, for example, https://contoso.sharepoint.com/sites/HumanResources.
      isArray: false
      name: site
      required: false
    - description: Email address of the user's mailbox.
      isArray: false
      name: email
      required: false
    description: Create a new eDiscoveryNoncustodialDataSource object.
    execution: false
    name: msg-create-ediscovery-non-custodial-data-source
    outputs:
    - contextPath: MsGraph.NoncustodialDataSource.CreatedDateTime
      description: Created date and time of the nonCustodialDataSource.
      type: Date
    - contextPath: MsGraph.NoncustodialDataSource.DataSourceId
      description: Unique identifier of the nonCustodialDataSource.
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.DataSourceStatus
      description: 'Latest status of the nonCustodialDataSource. Possible values are: Active, Released.'
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.DisplayName
      description: Display name of the noncustodialDataSource.
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.HoldStatus
      description: 'The hold status of the nonCustodialDataSource.The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.LastModifiedDateTime
      description: Last modified date and time of the nonCustodialDataSource.
      type: Date
    - contextPath: MsGraph.NoncustodialDataSource.ReleasedDateTime
      description: Date and time that the nonCustodialDataSource was released from the case.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the dataSource. If provided, only this ID will be returned.
      isArray: false
      name: data_source_id
      required: false
    - description: The maximum number of results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
    description: Get a list of the non-custodial data sources and their properties.
    execution: false
    name: msg-list-ediscovery-non-custodial-data-sources
    outputs:
    - contextPath: MsGraph.NoncustodialDataSource.CreatedDateTime
      description: Created date and time of the nonCustodialDataSource.
      type: Date
    - contextPath: MsGraph.NoncustodialDataSource.DataSourceId
      description: Unique identifier of the nonCustodialDataSource.
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.DataSourceStatus
      description: 'Latest status of the nonCustodialDataSource. Possible values are: Active, Released.'
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.DisplayName
      description: Display name of the noncustodialDataSource.
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.HoldStatus
      description: 'The hold status of the nonCustodialDataSource.The possible values are: notApplied, applied, applying, removing, partial.'
      type: String
    - contextPath: MsGraph.NoncustodialDataSource.LastModifiedDateTime
      description: Last modified date and time of the nonCustodialDataSource.
      type: Date
    - contextPath: MsGraph.NoncustodialDataSource.ReleasedDateTime
      description: Date and time that the nonCustodialDataSource was released from the case.
      type: Date
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: A comma-separated list of custodians IDs to apply a hold to.
      isArray: true
      name: custodian_id
      required: true
    description: |-
      Start the process of applying hold on eDiscovery custodians.
      Available return statuses: 
      notApplied - The custodian is not on hold (all sources in it are not on hold).
      applied - The custodian is on hold (all sources are on hold).
      applying - The custodian is in applying the hold state (applyHold operation triggered).
      removing - The custodian is in removing the hold state(removeHold operation triggered).
      partial - The custodian is in a mixed state where some sources are on hold and some not on hold or error state.
    execution: false
    name: msg-apply-hold-ediscovery-custodian
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: A comma-separated list of custodians IDs to remove a hold from.
      isArray: true
      name: custodian_id
      required: true
    description: Start the process of removing a hold from eDiscovery custodians.
    execution: false
    name: msg-remove-hold-ediscovery-custodian
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The display name of the search.
      isArray: false
      name: display_name
      required: true
    - description: The description of the search.
      isArray: false
      name: description
      required: false
    - description: The query string used for the search. The query string format is KQL (Keyword Query Language). For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values, for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
      isArray: false
      name: content_query
      required: false
    - description: When specified, the collection will span across a service for an entire workload.
      isArray: false
      name: data_source_scopes
      required: false
      auto: PREDEFINED
      predefined:
      - none
      - allTenantMailboxes
      - allTenantSites
      - allCaseCustodians
      - allCaseNoncustodialDataSources
    description: Create a new eDiscoverySearch object.
    execution: false
    name: msg-create-ediscovery-search
    outputs:
    - contextPath: MsGraph.eDiscoverySearch.ContentQuery
      description: 'The query string in KQL (Keyword Query Language) query. For details, see https://learn.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.'
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.Application.DisplayName
      description: Name of the application who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.Application.ID
      description: ID of the application who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.DisplayName
      description: Name of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.ID
      description: ID of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedDateTime
      description: The date and time the eDiscovery search was created.
      type: Date
    - contextPath: MsGraph.eDiscoverySearch.DataSourceScopes
      description: 'When specified, the collection will span across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources.'
      type: String
    - contextPath: MsGraph.eDiscoverySearch.Description
      description: The description of the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.DisplayName
      description: The display name of the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedDateTime
      description: 'The last date and time the eDiscovery search was modified.'
      type: Date
    - contextPath: MsGraph.eDiscoverySearch.SearchId
      description: The ID for the eDiscovery search.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: true
    - description: The display name of the search.
      isArray: false
      name: display_name
      required: true
    - description: The description of the search.
      isArray: false
      name: description
      required: false
    - description: The query string used for the search. The format of the query string is KQL (Keyword Query Language). For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values, for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
      isArray: false
      name: content_query
      required: false
    - description: When specified, the collection will span across a service for an entire workload.
      isArray: false
      name: data_source_scopes
      required: false
      auto: PREDEFINED
      predefined:
      - none
      - allTenantMailboxes
      - allTenantSites
      - allCaseCustodians
      - allCaseNoncustodialDataSources
    description: Update an eDiscoverySearch object.
    execution: false
    name: msg-update-ediscovery-search
  - arguments:
    - description: The id of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search. If provided, only this ID will be returned.
      isArray: false
      name: search_id
      required: false
    - description: The maximum number of results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - auto: PREDEFINED
      description: Show all results if true.
      isArray: false
      name: all_results
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Get a list of eDiscoverySearch resources from an eDiscovery case.
    execution: false
    name: msg-list-ediscovery-searchs
    outputs:
    - contextPath: MsGraph.eDiscoverySearch.ContentQuery
      description: 'The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values, for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.'
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.Application.DisplayName
      description: Name of the application who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.Application.ID
      description: ID of the application who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.DisplayName
      description: Name of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.ID
      description: ID of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedBy.User.UserPrincipalName
      description: Internet-style login name of the user who created the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.CreatedDateTime
      description: The date and time the eDiscovery search was created.
      type: Date
    - contextPath: MsGraph.eDiscoverySearch.DataSourceScopes
      description: 'When specified, the collection will span across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources.'
      type: String
    - contextPath: MsGraph.eDiscoverySearch.Description
      description: The description of the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.DisplayName
      description: The display name of the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.SearchId
      description: The ID for the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedDateTime
      description: The last date and time the eDiscovery search was modified.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.Application.DisplayName
      description: Name of the application who last modified the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.Application.ID
      description: ID of the application who last modified the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.User.DisplayName
      description: Name of the user who last modified the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.User.ID
      description: ID of the user who last modified the eDiscovery search.
      type: String
    - contextPath: MsGraph.eDiscoverySearch.LastModifiedBy.User.UserPrincipalName
      description: Internet-style login name of the user who last modified the eDiscovery search.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: false
    description: Delete an eDiscoverySearch object.
    execution: true
    name: msg-delete-ediscovery-search
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: true
    - description: "Specify the statistics to generate. The possible values are: includeRefiners, includeQueryStats, includeUnindexedStats, advancedIndexing, locationsWithoutHits. The advancedIndexing and locationsWithoutHits values are only considered if includeUnindexedStats is set."
      isArray: false
      name: statistics_options
      required: false
      auto: PREDEFINED
      predefined:
        - 'includeRefiners'
        - 'includeQueryStats'
        - 'includeUnindexedStats'
        - 'advancedIndexing'
        - 'locationsWithoutHits'
    description: Starts an eDiscovery estimate statistics operation in Microsoft Purview. The operation calculates the size and number of items matching the search query.
    execution: false
    name: msg-run-estimate-statistics
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: true
    outputs:
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.CaseID
        description: The ID of the eDiscovery case.
        type: String
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.SearchID
        description: The ID of the eDiscovery search.
        type: String
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.OperationID
        description: The ID of the last estimate statistics operation.
        type: String
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.Status
        description: The current status of the last estimate statistics operation (e.g., running, succeeded, failed).
        type: String
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.PercentProgress
        description: The percent progress of the last estimate statistics operation.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.CreatedDateTime
        description: The date and time when the estimate operation was created.
        type: Date
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.CompletedDateTime
        description: The date and time when the estimate operation completed.
        type: Date
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.IndexedItemsCount
        description: The number of indexed items found in the search.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.IndexedItemsSize
        description: The total size (in bytes) of indexed items.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.UnindexedItemsCount
        description: The number of unindexed items found in the search.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.UnindexedItemsSize
        description: The total size (in bytes) of unindexed items.
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.TotalItemsCount
        description: The total number of items (indexed + unindexed).
        type: Number
      - contextPath: MsGraph.eDiscovery.EstimateStatistics.TotalItemsSize
        description: The total size (in bytes) of all items (indexed + unindexed).
        type: Number
    description:  Retrieves the most recent eDiscovery estimate statistics operation for a given search in Microsoft Purview. Use this command after running 'msg-run-estimate-statistics' to check the results.
    execution: false
    polling: true
    name: msg-get-last-estimate-statistics-operation
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the eDiscovery search.
      isArray: false
      name: search_id
      required: true
    - description: Whether the action is soft delete or hard delete.
      isArray: false
      name: purge_type
      required: false
      auto: PREDEFINED
      predefined:
      - permanentlyDelete
      - recoverable
    - description: Define the locations to be in scope of the purge action.
      isArray: false
      name: purge_areas
      required: false
      auto: PREDEFINED
      predefined:
      - teamsMessages
      - mailboxes
    description: |-
      Deletes mailbox items in Exchange or messages in Microsoft Teams that are included in an eDiscovery search.

      You can collect and purge the following categories of Teams content:

      Teams 1:1 chats - Chat messages, posts, and attachments shared in a Teams conversation between two people. Teams 1:1 chats are also called conversations.
      Teams group chats - Chat messages, posts, and attachments shared in a Teams conversation between three or more people. Also called 1:N chats or group conversations.
      Teams channels - Chat messages, posts, replies, and attachments shared in a standard Teams channel.
      Private channels - Message posts, replies, and attachments shared in a private Teams channel.
      Shared channels - Message posts, replies, and attachments shared in a shared Teams channel.
    execution: false
    name: msg-purge-ediscovery-data
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.Purge.OperationID
      description: The ID of the purge operation. Use this ID to retrieve the operation status via 'msg-list-case-operation'.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Purge.Status
      description: The status of the purge operation.
      type: String
  - arguments:
    - description: The email address of the user who received the email.
      isArray: false
      name: recipient_email
      required: true
    - description: The expected assessment.
      isArray: false
      name: expected_assessment
      auto: PREDEFINED
      predefined:
      - 'block'
      - 'unblock'
      required: true
    - description: The category of the threat.
      isArray: false
      name: category
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'spam'
      - 'phishing'
      - 'malware'
      required: true
    - description: Message user. Could be the user's ID or the user's email.
      isArray: false
      name: message_user
      required: true
    - description: "Message ID. Message has to contain the 'X-MS-Exchange-Organization-Network-Message-Id' header in the message or the 'X-MS-Office365-Filtering-Correlation-Id' header in quarantined messages. Use the msgraph-mail-list-emails command from the Microsoft Graph Mail pack  with the proper user_id in order to get all available messages."
      isArray: false
      name: message_id
      required: true
    - description: The ID of the request (generated in the polling command).
      name: request_id
      deprecated: true
    - description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
      deprecated: true
      defaultValue: '720'
    description: Create and retrieve a mail threat assessment.
    execution: false
    name: msg-create-mail-assessment-request
    polling: true
    outputs:
    - contextPath: MSGraphMail.MailAssessment.ID
      description: Mail assessment ID.
      type: String
    - contextPath: MSGraphMail.MailAssessment.CreatedDateTime
      description: The datetime the mail assessment was created.
      type: String
    - contextPath: MSGraphMail.MailAssessment.ContentType
      description: The content type.
      type: String
    - contextPath: MSGraphMail.MailAssessment.ExpectedAssessment
      description: The expected assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.Category
      description: The category of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.Status
      description: The status of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.RequestSource
      description: The request source of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.RecipientEmail
      description: The email recipient of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.DestinationRoutingReason
      description: The destination routing reason for the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.MessageID
      description: The message ID of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.CreatedUserID
      description: The user ID that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.CreatedUsername
      description: The user name that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.ResultType
      description: The result type of the mail assessment.
      type: String
    - contextPath: MSGraphMail.MailAssessment.ResultMessage
      description: The result message of the mail assessment.
      type: String
  - arguments:
    - description: The email of the user who recieved the mail.
      isArray: false
      name: recipient_email
      required: true
    - description: The expected assessment.
      isArray: false
      name: expected_assessment
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'block'
      - 'unblock'
      required: true
    - description: The category of the threat.
      isArray: false
      name: category
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'spam'
      - 'phishing'
      - 'malware'
      required: true
    - description: Base 64 encoded eml file.
      isArray: false
      name: content_data
      required: false
    - description: Entry ID.
      isArray: false
      name: entry_id
      required: false
    - description: The ID of the request (generated in the polling command).
      name: request_id
      deprecated: true
    - description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
      deprecated: true
      defaultValue: '720'
    description: Create email file assessment request.
    execution: false
    name: msg-create-email-file-assessment-request
    polling: true
    outputs:
    - contextPath: MSGraphMail.EmailAssessment.ID
      description: The mail assessment ID.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.CreatedDateTime
      description: The datetime the mail assessment was created.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.ContentType
      description: The content type.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.ExpectedAssessment
      description: The expected assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.Category
      description: The category of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.Status
      description: The status of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.RequestSource
      description: The request source of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.RecipientEmail
      description: The email recipient of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.DestinationRoutingReason
      description: The destination routing reason for the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.CreatedUserID
      description: The user ID that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.CreatedUsername
      description: The user name that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.ResultType
      description: The result type of the mail assessment.
      type: String
    - contextPath: MSGraphMail.EmailAssessment.ResultMessage
      description: The result message of the mail assessment.
      type: String
  - arguments:
    - description: The expected assessment.
      isArray: false
      name: expected_assessment
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'block'
      - 'unblock'
      required: true
    - description: The category of the threat.
      isArray: false
      name: category
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'phishing'
      - 'malware'
      required: true
    - description: The file name.
      isArray: false
      name: file_name
      required: true
    - description: Base 64 encoded text file.
      isArray: false
      name: content_data
      required: false
    - description: Entry ID.
      isArray: false
      name: entry_id
      required: false
    - description: Whether to hide the polling result (automatically filled by polling).
      name: hide_polling_output
      deprecated: true
    - description: The ID of the request (generated in the polling command).
      name: request_id
      deprecated: true
    description: Create file assessment request.
    execution: false
    name: msg-create-file-assessment-request
    polling: true
    outputs:
    - contextPath: MSGraphMail.FileAssessment.ID
      description: The mail assessment ID.
      type: String
    - contextPath: MSGraphMail.FileAssessment.CreatedDateTime
      description: The datetime the file assessment was created.
      type: String
    - contextPath: MSGraphMail.FileAssessment.ContentType
      description: The content type.
      type: String
    - contextPath: MSGraphMail.FileAssessment.ExpectedAssessment
      description: The expected assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.Category
      description: The category of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.Status
      description: The status of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.RequestSource
      description: The request source of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.FileName
      description: The file name of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.CreatedUserID
      description: The user ID that was created for the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.CreatedUsername
      description: The user name that was created for the mail assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.ResultType
      description: The result type of the file assessment.
      type: String
    - contextPath: MSGraphMail.FileAssessment.ResultMessage
      description: The result message of the file assessment.
      type: String
  - arguments:
    - description: The expected assessment.
      isArray: false
      name: expected_assessment
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'block'
      - 'unblock'
      required: true
    - description: The category of the threat.
      isArray: false
      name: category
      defaultValue: all
      auto: PREDEFINED
      predefined:
      - 'phishing'
      - 'malware'
      required: true
    - description: The URL of the threat.
      isArray: false
      name: url
      required: true
    - description: The request_id (generated in the polling command).
      name: request_id
      deprecated: true
    - description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
      deprecated: true
      defaultValue: '720'
    description: Create the URL assessment request.
    execution: false
    name: msg-create-url-assessment-request
    polling: true
    outputs:
    - contextPath: MSGraphMail.UrlAssessment.ID
      description: The mail assessment ID.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.Url
      description: The URL of the URL assessment.
      type: string
    - contextPath: MSGraphMail.UrlAssessment.CreatedDateTime
      description: The datetime the URL assessment was created.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.ContentType
      description: The content type of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.ExpectedAssessment
      description: The expected assessment of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.Category
      description: The category of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.Status
      description: The status of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.RequestSource
      description: The request source for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.RecipientEmail
      description: The recipient email for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.DestinationRoutingReason
      description: The destination routing reason for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.CreatedUserID
      description: The user ID created for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.CreatedUsername
      description: The user name created for the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.ResultType
      description: The result type of the URL assessment.
      type: String
    - contextPath: MSGraphMail.UrlAssessment.ResultMessage
      description: The result message of the URL assessment.
      type: String
  - arguments:
    - description: The request ID.
      isArray: false
      name: request_id
      required: false
    - description: The filter for the request. Example category eq 'malware’ and ContentType eq 'file'. Available fields are expectedAssessment, ContentType, status, requestSource.
      isArray: false
      name: filter
      required: false
    - description: The order by which to retrieve the results.
      isArray: false
      name: order_by
      auto: PREDEFINED
      predefined:
      - 'id'
      - 'createdDateTime'
      - 'ContentType'
      - 'expectedAssessment'
      - 'category'
      - 'status'
      - 'requestSource'
      required: false
    - description: The sort order.
      isArray: false
      name: sort_order
      auto: PREDEFINED
      predefined:
      - 'asc'
      - 'desc'
      required: false
    - description: The maximum number of results to retrieve.
      isArray: false
      name: limt
      required: false
    - description: The next token.
      isArray: false
      name: next_token
      required: false
    description: Get a list of the threat assessment requests.
    execution: false
    name: msg-list-threat-assessment-requests
    polling: true
    outputs:
    - contextPath: MsGraph.AssessmentRequestNextToken.next_token
      description: The next token for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ID
      description: The assessment request ID.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.CreatedDateTime
      description: The datetime the assessment request was created.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ContentType
      description: The content type of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ExpectedAssessment
      description: The expected assessment of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.Category
      description: The category of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.Status
      description: The status of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.URL
      description: The URL of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.RequestSource
      description: The request source for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.RecipientEmail
      description: The email recipient for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.FileName
      description: The file name of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.DestinationRoutingReason
      description: The destination routing reason for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.CreatedUserID
      description: The user ID create for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.CreatedUsername
      description: The user name created for the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ResultType
      description: The result type of the assessment request.
      type: String
    - contextPath: MSGraphMail.AssessmentRequest.ResultMessage
      description: The result message of the assessment request.
      type: String
  - arguments:
    - name: query
      description: Advanced hunting query.
      required: true
    - name: limit
      description: Number of entries. Enter -1 for unlimited query. In case a limit also appears in the query, priority will be given to the query.
      defaultValue: '50'
    - name: timeout
      description: The time limit in seconds for the http request to run.
      defaultValue: '50'
    description: Advanced hunting is a threat-hunting tool that uses specially constructed queries to examine the past 30 days of event data in Microsoft Graph Security.
    name: msg-advanced-hunting
    outputs:
    - contextPath: MsGraph.Hunt.query
      description: The query used. Also acted as a key.
      type: String
    - contextPath: MsGraph.Hunt.results
      description: The results of the query.
      type: Unknown
    - contextPath: Microsoft365Defender.Hunt.query
      description: The query used. Also acted as a key.
      type: String
    - contextPath: Microsoft365Defender.Hunt.results
      description: The results of the query.
      type: Unknown
  - arguments:
    - name: incident_id
      description: Incident's ID.
    - name: limit
      description: Number of incidents in the list. Maximum is 50.
      defaultValue: '50'
    - name: timeout
      description: The time limit in seconds for the http request to run.
      defaultValue: '50'
    - name: status
      description: The status of the incident.
      auto: PREDEFINED
      predefined:
      - 'active'
      - 'redirected'
      - 'resolved'
      - 'inProgress'
      - 'unknownFutureValue'
      - 'awaitingAction'
    - name: assigned_to
      description: Owner of the incident.
    - name: severity
      description: Indicates the possible impact on assets. The higher the severity, the greater the impact. Typically higher severity items require the most immediate attention.
      auto: PREDEFINED
      predefined:
      - 'unknown'
      - 'informational'
      - 'low'
      - 'medium'
      - 'high'
      - 'unknownFutureValue'
    - name: classification
      description: The specification for the incident.
    - name: odata
      description: Filter incidents using 'odata' query.
    - name: extra_data
      description: Whether to include each incident's related alerts in the response.
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    description: Get a list of incident objects that Microsoft graph created to track attacks in an organization. If you want a specific incident, just enter incident_id.
    name: msg-list-security-incident
    outputs:
    - contextPath: MsGraph.Incident.assignedTo
      description: Owner of the incident, or null if no owner is assigned. Free editable text.
      type: string
    - contextPath: MsGraph.Incident.classification
      description: The specification for the incident. Possible values are unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
      type: string
    - contextPath: MsGraph.Incident.comments
      description: Array of comments created by the Security Operations (SecOps) team when the incident is managed.
      type: string
    - contextPath: MsGraph.Incident.createdDateTime
      description: Time when the incident was first created.
      type: date
    - contextPath: MsGraph.Incident.customTags
      description: Array of custom tags associated with an incident.
      type: string
    - contextPath: MsGraph.Incident.description
      description: Description of the incident.
      type: string
    - contextPath: MsGraph.Incident.determination
      description: Specifies the determination of the incident. Possible values are unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.
      type: string
    - contextPath: MsGraph.Incident.displayName
      description: The incident name.
      type: string
    - contextPath: MsGraph.Incident.id
      description: Unique identifier to represent the incident.
      type: number
    - contextPath: MsGraph.Incident.incidentWebUrl
      description: The URL for the incident page in the Microsoft 365 Defender portal.
      type: string
    - contextPath: MsGraph.Incident.lastModifiedBy
      description: The identity that last modified the incident.
      type: string
    - contextPath: MsGraph.Incident.lastUpdateDateTime
      description: Time when the incident was last updated.
      type: string
    - contextPath: MsGraph.Incident.redirectIncidentId
      description: Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected.
      type: string
    - contextPath: MsGraph.Incident.severity
      description: Indicates the possible impact on assets. The higher the severity, the bigger the impact. Typically higher severity items require the most immediate attention. Possible values are unknown, informational, low, medium, high, unknownFutureValue.
      type: string
    - contextPath: MsGraph.Incident.status
      description: The status of the incident. Possible values are active, resolved, inProgress, redirected, unknownFutureValue, and awaitingAction.
      type: string
    - contextPath: MsGraph.Incident.tenantId
      description: The Microsoft Entra tenant in which the alert was created.
      type: string
    - contextPath: MsGraph.Incident.systemTags
      description: The system tags associated with the incident.
      type: string
  - arguments:
    - name: incident_id
      description: Incident's ID.
      required: true
    - name: status
      description: Categorize incidents (as Active, Resolved, or Redirected).
      auto: PREDEFINED
      predefined:
      - active
      - resolved
      - redirected
      - unknownFutureValue
    - name: assigned_to
      description: Owner of the incident.
    - name: determination
      description: Determination of the incident.
      auto: PREDEFINED
      predefined:
      - unknown
      - apt
      - malware
      - securityPersonnel
      - unwantedSoftware
      - other
      - multiStagedAttack
      - compromisedUser
      - phishing
      - maliciousUserActivity
      - notMalicious
    - name: classification
      description: The specification for the incident.
      auto: PREDEFINED
      predefined:
      - unknown
      - falsePositive
      - truePositive
      - informationalExpectedActivity
      - unknownFutureValue
    - name: severity
      description: 'Indicates the possible impact on assets. The higher the severity, the bigger the impact. Typically, higher severity items require the most immediate attention. The possible values are: unknown, informational, low, medium, high, unknownFutureValue.'
      auto: PREDEFINED
      predefined:
      - unknown
      - informational
      - low
      - medium
      - high
      - unknownFutureValue
    - name: resolving_comment
      description: User input that explains the resolution of the incident and the classification choice. It contains free editable text.
    - name: custom_tags
      description: Array of custom tags associated with an incident.
    - name: timeout
      description: The time limit in seconds for the http request to run.
      defaultValue: '50'
    description: Update the incident with the given ID.
    name: msg-update-security-incident
    outputs:
    - contextPath: MsGraph.Incident.assignedTo
      description: Owner of the incident, or null if no owner is assigned. Free editable text.
      type: String
    - contextPath: MsGraph.Incident.classification
      description: The specification for the incident. Possible values are unknown, falsePositive, truePositive, informationalExpectedActivity, unknownFutureValue.
      type: String
    - contextPath: MsGraph.Incident.comments
      description: Array of comments created by the Security Operations (SecOps) team when the incident is managed.
      type: String
    - contextPath: MsGraph.Incident.createdDateTime
      description: Time when the incident was first created.
      type: Date
    - contextPath: MsGraph.Incident.customTags
      description: Array of custom tags associated with an incident.
      type: String
    - contextPath: MsGraph.Incident.description
      description: Description of the incident.
      type: String
    - contextPath: MsGraph.Incident.determination
      description: Specifies the determination of the incident. Possible values are unknown, apt, malware, securityPersonnel, securityTesting, unwantedSoftware, other, multiStagedAttack, compromisedUser, phishing, maliciousUserActivity, clean, insufficientData, confirmedUserActivity, lineOfBusinessApplication, unknownFutureValue.
      type: String
    - contextPath: MsGraph.Incident.displayName
      description: The incident name.
      type: String
    - contextPath: MsGraph.Incident.id
      description: Unique identifier to represent the incident.
      type: String
    - contextPath: MsGraph.Incident.incidentWebUrl
      description: The URL for the incident page in the Microsoft 365 Defender portal.
      type: String
    - contextPath: MsGraph.Incident.lastModifiedBy
      description: The identity that last modified the incident.
      type: String
    - contextPath: MsGraph.Incident.lastUpdateDateTime
      description: Time when the incident was last updated.
      type: Date
    - contextPath: MsGraph.Incident.redirectIncidentId
      description: Only populated in case an incident is grouped with another incident, as part of the logic that processes incidents. In such a case, the status property is redirected.
      type: String
    - contextPath: MsGraph.Incident.severity
      description: Indicates the possible impact on assets. The higher the severity, the bigger the impact. Typically higher severity items require the most immediate attention. Possible values are unknown, informational, low, medium, high, unknownFutureValue.
      type: String
    - contextPath: MsGraph.Incident.status
      description: The status of the incident. Possible values are active, resolved, inProgress, redirected, unknownFutureValue, and awaitingAction.
      type: String
    - contextPath: MsGraph.Incident.tenantId
      description: The Microsoft Entra tenant in which the alert was created.
      type: String
    - contextPath: MsGraph.Incident.systemTags
      description: The system tags associated with the incident.
      type: String collection
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The display name of the legal hold policy.
      isArray: false
      name: display_name
      required: true
    - description: The description of the legal hold policy.
      isArray: false
      name: description
      required: false
    - description: KQL query specifying content to be held in the specified locations. Learn about KQL (https://learn.microsoft.com/en-us/kusto/query/?view=azure-data-explorer&preserve-view=true).
      isArray: false
      name: content_query
      required: false
    description: Create a new ediscoveryHoldPolicy object.
    name: msg-create-ediscovery-case-hold-policy
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.ID
      description: The ID of the eDiscovery hold policy.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.DisplayName
      description: The display name of the legal hold.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Description
      description: The legal hold description.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.ContentQuery
      description: KQL query that specifies content to be held. If empty, all content in the specified locations is held.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.IsEnabled
      description: Indicates whether the hold is enabled and actively holding content.
      type: Boolean
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Status
      description: The status of the legal hold. Possible values are Pending, Error, Success.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Errors
      description: Lists any errors that happened while placing the hold.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedDateTime
      description: The date and time the legal hold was created.
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedDateTime
      description: The date and time the legal hold was last modified.
      type: Date
    # --- createdBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
    # --- lastModifiedBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The policy ID that is intended to be deleted.
      isArray: false
      name: hold_policy_id
      required: true
    description: Delete an eDiscovery hold policy. This command submits a deletion request to Microsoft Graph; the policy may not be removed immediately and can take some time to complete.
    name: msg-delete-ediscovery-case-hold-policy
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The policy ID that is intended to be updated.
      isArray: false
      name: hold_policy_id
      required: true
    - description: The description of the legal hold policy.
      isArray: false
      name: description
      required: false
    - description: KQL query specifying content to be held in the specified locations. Learn about KQL (https://learn.microsoft.com/en-us/kusto/query/?view=azure-data-explorer&preserve-view=true).
      isArray: false
      name: content_query
      required: false
    description: Update the properties of an ediscoveryHoldPolicy object.
    name: msg-update-ediscovery-case-hold-policy
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the legal hold policy.
      isArray: false
      name: hold_policy_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - description: Show all results if true.
      isArray: false
      name: all_results
      required: false
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
      auto: PREDEFINED
    description: Get a list of the ediscoveryHoldPolicy objects and their properties.
    name: msg-list-ediscovery-case-hold-policy
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.ID
      description: The ID of the eDiscovery hold policy.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.DisplayName
      description: The display name of the legal hold.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Description
      description: The legal hold description.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.ContentQuery
      description: KQL query that specifies content to be held. If empty, all content in the specified locations is held.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.IsEnabled
      description: Indicates whether the hold is enabled and actively holding content.
      type: Boolean
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Status
      description: The status of the legal hold. Possible values are Pending, Error, Success.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.Errors
      description: Lists any errors that happened while placing the hold.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedDateTime
      description: The date and time the legal hold was created.
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedDateTime
      description: The date and time the legal hold was last modified.
      type: Date
    # --- createdBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.CreatedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
    # --- lastModifiedBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.HoldPolicy.LastModifiedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the operation.
      isArray: false
      name: operation_id
      required: false
    - description: Number of total results to return.
      isArray: false
      name: limit
      required: false
      defaultValue: 50
    - description: Show all results if true.
      isArray: false
      name: all_results
      required: false
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
      auto: PREDEFINED
    - description: 'Download the export report when an export file link is available. This only applies if `operation_id` is provided. For authorization or permission errors while downloading, see: https://learn.microsoft.com/en-us/graph/api/security-caseoperation-get?view=graph-rest-1.0&tabs=http#response-1'
      name: download_file
      isArray: false
      required: false
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
      auto: PREDEFINED
    description: Get a list of the caseOperation objects and their properties, or retrieve a specific operation by ID. When operation_id is provided, you can set download_file=true to download the export report (if available).
    name: msg-list-case-operation
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.Operation.ID
      description: The ID of the case operation. Read-only.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.Action
      description: >
        The type of action the operation represents (caseAction).
        Example values: contentExport, applyTags, convertToPdf, index, estimateStatistics,
        addToReviewSet, holdUpdate, purgeData, exportReport, exportResult, holdPolicySync.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.Status
      description: >
        The status of the case operation.
        Possible values: notStarted, submissionFailed, running, succeeded, partiallySucceeded, failed.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.PercentProgress
      description: The progress of the operation.
      type: Number
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedDateTime
      description: The date and time the operation was created.
      type: Date
    - contextPath: MsGraph.eDiscoveryCase.Operation.CompletedDateTime
      description: The date and time the operation was completed.
      type: Date
    # --- createdBy (identitySet) ---
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Application.ID
      description: The unique identifier of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Application.DisplayName
      description: The display name of the application associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Application.TenantId
      description: The tenant ID of the application identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ApplicationInstance.ID
      description: The unique identifier of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ApplicationInstance.DisplayName
      description: The display name of the application instance associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ApplicationInstance.TenantId
      description: The tenant ID of the application instance identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Conversation.ID
      description: The unique identifier of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Conversation.DisplayName
      description: The display name of the conversation (team or channel) associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Conversation.TenantId
      description: The tenant ID of the conversation identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ConversationIdentityType.ID
      description: The identifier describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ConversationIdentityType.DisplayName
      description: The display name describing whether the conversation identifies a team or channel.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.ConversationIdentityType.TenantId
      description: The tenant ID of the conversation identity type.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Device.ID
      description: The unique identifier of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Device.DisplayName
      description: The display name of the device associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Device.TenantId
      description: The tenant ID of the device identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Encrypted.ID
      description: The unique identifier of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Encrypted.DisplayName
      description: The display name of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Encrypted.TenantId
      description: The tenant ID of the encrypted identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.OnPremises.ID
      description: The unique identifier of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.OnPremises.DisplayName
      description: The display name of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.OnPremises.TenantId
      description: The tenant ID of the on-premises identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Guest.ID
      description: The unique identifier of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Guest.DisplayName
      description: The display name of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Guest.TenantId
      description: The tenant ID of the guest identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Phone.ID
      description: The unique identifier of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Phone.DisplayName
      description: The display name of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.Phone.TenantId
      description: The tenant ID of the phone identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.User.ID
      description: The unique identifier of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.User.DisplayName
      description: The display name of the user associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.CreatedBy.User.TenantId
      description: The tenant ID of the user identity associated with this action.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.ResultInfo.Code
      description: The result code (2xx success, 4xx client error, 5xx server error).
      type: Number
    - contextPath: MsGraph.eDiscoveryCase.Operation.ResultInfo.Message
      description: The result message.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Operation.ResultInfo.Subcode
      description: The result subcode.
      type: Number
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  - arguments:
    - description: The ID of the eDiscovery case.
      isArray: false
      name: case_id
      required: true
    - description: The ID of the search.
      isArray: false
      name: search_id
      required: true
    - description: The additional options for the export.
      isArray: false
      name: additional_options
      required: true
      auto: PREDEFINED
      predefined:
      - none
      - teamsAndYammerConversations
      - cloudAttachments
      - allDocumentVersions
      - subfolderContents
      - listAttachments
      - htmlTranscripts
      - advancedIndexing
      - allItemsInFolder
      - includeFolderAndPath
      - condensePaths
      - friendlyName
      - splitSource
      - includeReport
    - description: The portion of the estimate results to be exported.
      isArray: true
      name: export_criteria
      required: true
      auto: PREDEFINED
      predefined:
      - searchHits
      - partiallyIndexed
    - description: The desired format of the exported emails.
      isArray: false
      name: export_format
      required: true
      auto: PREDEFINED
      predefined:
      - pst
      - msg
    - description: The versions of cloud attachments to include in messages.
      isArray: false
      name: cloud_attachment_version
      required: false
      defaultValue: latest
      auto: PREDEFINED
      predefined:
      - latest
      - recent10
      - recent100
      - all
    - description: The description of the export result.
      isArray: false
      name: description
      required: false
    - description: The display name of the export result.
      isArray: false
      name: display_name
      required: true
    - description: The versions of files in SharePoint to include.
      isArray: false
      name: document_version
      required: false
      defaultValue: latest
      auto: PREDEFINED
      predefined:
      - latest
      - recent10
      - recent100
      - all
    - description: Location scope for partially indexed items. You can choose to include partially indexed items only in responsive locations with search hits or in all targeted locations.
      isArray: false
      name: export_location
      required: false
      auto: PREDEFINED
      predefined:
      - responsiveLocations
      - nonresponsiveLocations
    description: Export results from an estimated ediscoverySearch. For details, see Manage a collection estimate (https://learn.microsoft.com/en-us/purview/ediscovery-create-draft-collection#manage-a-collection-estimate).
    name: msg-export-result-ediscovery-data
    outputs:
    - contextPath: MsGraph.eDiscoveryCase.Export.OperationID
      description: The ID of the export operation. Use this ID to retrieve the operation status via 'msg-list-case-operation'.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Export.CaseID
      description: The ID of the eDiscovery case the export belongs to.
      type: String
    - contextPath: MsGraph.eDiscoveryCase.Export.Location
      description: The Location header URL returned for the export operation.
      type: String
  dockerimage: demisto/crypto:1.0.0.10120494
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  feed: false
tests:
- Microsoft Graph Security Test dev
- Microsoft Graph Security Test prod
- Microsoft Graph Security Test dev v2
- Microsoft Graph Security Test prod v2
- Microsoft Graph Security Test self deployed v2
- MSG-ediscovery-tpb
- MSG-Threat-Assessment-test
fromversion: 5.0.0