category: Email provider: Microsoft sectionorder: - Connect - Collect commonfields: id: SecurityAndComplianceV2 version: -1 configuration: - display: Certificate Password name: certificate_password type: 4 additionalinfo: Password used to sign the certificate. hidden: true section: Connect advanced: true required: false - display: Certificate name: certificate type: 4 additionalinfo: A pfx certificate encoded in Base64. hidden: true section: Connect advanced: true required: false - display: UPN/Email additionalinfo: User Principal Name (UPN) of the Microsoft account used for authentication. name: delegated_auth required: true type: 9 displaypassword: Password hiddenpassword: true section: Connect - display: UPN Password additionalinfo: Password for the specified UPN. Required when using interactive delegated authentication. Leave this field empty when using device code based authentication. name: credentials_app_secret required: false type: 9 displaypassword: UPN Password hiddenusername: true section: Connect - display: The organization used in app-only authentication. name: organization type: 0 section: Connect advanced: true required: false - display: The application ID from the Azure portal name: app_id type: 0 section: Connect advanced: true hidden: true required: false - display: The application ID from the Azure portal name: credentials_app_id required: false type: 9 section: Connect displaypassword: Password hiddenpassword: true - display: Trust any certificate (not secure) name: insecure defaultvalue: "false" type: 8 section: Connect advanced: true required: false - display: App Secret name: app_secret type: 4 section: Connect advanced: true required: false hidden: true - display: Tenant ID name: tenant_id type: 0 section: Connect advanced: true required: false hidden: true - display: Tenant ID name: credentials_tenant_id required: false type: 9 displaypassword: Password hiddenpassword: true section: Connect advanced: true - display: Connection URI name: connection_uri type: 0 defaultvalue: https://ps.compliance.protection.outlook.com/powershell-liveid/ additionalinfo: Please refer to the documentation for a list of known endpoints. section: Connect advanced: true required: false - display: AzureADAuthorizedEndpointURI Base name: azure_ad_authorized_endpoint_uri_base type: 0 additionalinfo: Excluding /common or / defaultvalue: https://login.microsoftonline.com section: Connect advanced: true required: false description: Deprecated. Use the Microsoft Graph Security integration instead. This integration allows you to manage and interact with Microsoft security and compliance content search. display: O365 - Security And Compliance - Content Search v2 (Deprecated) deprecated: true name: SecurityAndComplianceV2 script: commands: - description: OAuth2.0 - Start authorization. name: o365-sc-auth-start arguments: [] - description: OAuth2.0 - Complete authorization. name: o365-sc-auth-complete arguments: [] - description: OAuth2.0 - Test authorization. name: o365-sc-auth-test arguments: [] - description: Create compliance search in the Security & Compliance Center. name: o365-sc-new-search arguments: - description: | The name of the compliance search. If not specified, will have the prefix "XSOAR-" followed by the GUID e.g., XSOAR-d6228fd0-756b-4e4b-8721-76776df91526. name: search_name - description: The name of a Core eDiscovery case to associate with the new compliance search. name: case - description: Text search string or a query that is formatted using the Keyword Query Language (KQL). name: kql - description: Description of the compliance search. name: description - description: Whether to include mailboxes other than regular user mailboxes in the compliance search. Default is "false". name: allow_not_found_exchange_locations auto: PREDEFINED defaultValue: 'false' predefined: - 'true' - 'false' - description: Comma-separated list of mailboxes/distribution groups to include, or you can use the value "All" to include all. isArray: true name: exchange_location defaultValue: 'All' - description: Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter. Deprecated since Microsoft is supporting it only on-premise. isArray: true deprecated: true name: exchange_location_exclusion - description: Comma-separated list of public folders to include, or you can use the value "All" to include all. isArray: true name: public_folder_location - description: Comma-separated list of SharePoint online sites to include. You can identify the sites by their URL value, or you can use the value "All" to include all sites. isArray: true name: share_point_location - description: Comma-separated list of SharePoint online sites to exclude when you use the value "All" for the share_point_location argument. You can identify the sites by their URL value. isArray: true name: share_point_location_exclusion outputs: - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled description: Whether to include mailboxes other than regular user mailboxes in the compliance search. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled description: Whether the Azure Batch Framework is enabled for job processing. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseId description: Identity of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseName description: Name of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery description: Compliance text search string or a query that is formatted using the Keyword Query Language (KQL). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy description: Security and compliance search creator. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime description: Security and compliance search creation time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Description description: Security and compliance search description. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Errors description: Security and compliance search errors. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation description: Security and compliance search exchange locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Identity description: Security and compliance search identity. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.IsValid description: Whether the security and compliance search is valid. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Items description: The number of security and compliance search scanned items. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime description: Security and compliance search job end time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobId description: Security and compliance search job ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobRunId description: Security and compliance search job run ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime description: Security and compliance search job run start time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime description: Security and compliance search last modification time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LogLevel description: Security and compliance search Azure log level. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Name description: Security and compliance search name. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation description: Security and compliance search OneDrive locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion description: Security and compliance search OneDrive locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation description: Security and compliance search public folder locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion description: Security and compliance search public folder locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunBy description: Security and compliance search last run by UPN (Email representation). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId description: Security and compliance search run space ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation description: Security and compliance search SharePoint locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Size description: Security and compliance search bytes results size. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Status description: Security and compliance search status. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.TenantId description: Security and compliance search Tenant ID. type: String - description: Modifies non-running compliance searches in the Security & Compliance Center. name: o365-sc-set-search arguments: - description: The name of the compliance search. name: search_name required: true - description: Modify the text search string or a query that is formatted using the Keyword Query Language (KQL). name: kql - description: Modify the description for the compliance search. name: description - description: Whether to include mailboxes other than regular user mailboxes in the compliance search. name: allow_not_found_exchange_locations auto: PREDEFINED predefined: - 'true' - 'false' - description: Comma-separated list of added mailboxes/distribution groups to include, or you can use the value "All" to include all mailboxes. isArray: true name: add_exchange_location - description: Comma-separated list of added mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location (used in create new compliance search) or the add_exchange_location argument. isArray: true name: add_exchange_location_exclusion - description: Comma-separated list of added public folders to include, or you can use the value "All" to include all. isArray: true name: add_public_folder_location - description: Comma-separated list of added SharePoint online sites to include. You identify the sites by their URL value, or you can use the value "All" to include all sites. isArray: true name: add_share_point_location - description: Comma-separated list of added SharePoint online sites to exclude when you use the value "All" for the exchange_location (used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value. isArray: true name: add_share_point_location_exclusion - description: Comma-separated list of removed mailboxes/distribution group to include. isArray: true name: remove_exchange_location - description: Comma-separated list of removed mailboxes/distribution group to exclude when you use the value "All" for the exchange_location (Used in create new compliance search) or the add_exchange_location argument. isArray: true name: remove_exchange_location_exclusion - description: Comma-separated list of removed public folders to include. isArray: true name: remove_public_folder_location - description: Comma-separated list of removed SharePoint online sites to include. You can identify the sites by their URL value. isArray: true name: remove_share_point_location - description: Comma-separated list of removed SharePoint online sites to exclude when you use the value "All" for the exchange_location (Used in create new compliance search) argument or the share_point_location argument. You can identify the sites by their URL value. isArray: true name: remove_share_point_location_exclusion - description: Remove compliance search by name from the Security & Compliance Center. name: o365-sc-remove-search arguments: - description: The name of the compliance search. name: search_name required: true - description: List compliance searches in the Security & Compliance Center. name: o365-sc-list-search outputs: - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled description: Whether to include mailboxes other than regular user mailboxes in the compliance search. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled description: Whether the Azure Batch Framework is enabled for job processing. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseId description: Identity of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseName description: Name of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery description: Compliance text search string or a query that is formatted using the Keyword Query Language (KQL). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy description: Security and compliance search creator. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime description: Security and compliance search creation time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Description description: Security and compliance search description. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Errors description: Security and compliance search errors. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation description: Security and compliance search exchange locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Identity description: Security and compliance search identity. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.IsValid description: Whether the security and compliance search is valid. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Items description: The number of security and compliance search scanned items. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime description: Security and compliance search job end time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobId description: Security and compliance search job ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobRunId description: Security and compliance search job run ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime description: Security and compliance search job run start time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime description: Security and compliance search last modification time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LogLevel description: Security and compliance search Azure log level. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Name description: Security and compliance search name. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation description: Security and compliance search OneDrive locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion description: Security and compliance search OneDrive locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation description: Security and compliance search public folder locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion description: Security and compliance search public folder locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunBy description: Security and compliance search last run by UPN (Email representation). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId description: Security and compliance search run space ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation description: Security and compliance search SharePoint locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Size description: Security and compliance search bytes results size. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Status description: Security and compliance search status. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.TenantId description: Security and compliance search Tenant ID. type: String arguments: [] - arguments: - description: The name of the compliance search. name: search_name required: true - description: The maximum number of results to return. If you want to return all requests that match the query, use "-1" for the value of this argument. name: limit defaultValue: '100' - description: Whether to include mailboxes which have no results in results entry context. name: all_results auto: PREDEFINED defaultValue: 'false' predefined: - 'true' - 'false' - description: Whether to export search results as json file to war-room. name: export auto: PREDEFINED predefined: - 'true' - 'false' defaultValue: 'false' - description: Show search statistics. Default is "false". name: statistics auto: PREDEFINED defaultValue: 'false' predefined: - 'true' - 'false' description: Gets compliance search by name from the Security & Compliance Center. name: o365-sc-get-search outputs: - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AllowNotFoundExchangeLocationsEnabled description: Whether to include mailboxes other than regular user mailboxes in the compliance search. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.AzureBatchFrameworkEnabled description: Whether the Azure Batch Framework is enabled for job processing. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseId description: Identity of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CaseName description: Name of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ContentMatchQuery description: Compliance text search string or a query that is formatted using the Keyword Query Language (KQL). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedBy description: Security and compliance search creator. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.CreatedTime description: Security and compliance search creation time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Description description: Security and compliance search description. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Errors description: Security and compliance search errors. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.ExchangeLocation description: Security and compliance search exchange locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Identity description: Security and compliance search identity. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.IsValid description: Whether the security and compliance search is valid. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Items description: Number of security and compliance search scanned items. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobEndTime description: Security and compliance search job end time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobId description: Security and compliance search job ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobRunId description: Security and compliance search job run ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.JobStartTime description: Security and compliance search job run start time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LastModifiedTime description: Security and compliance search last modification time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.LogLevel description: Security and compliance search the Azure log level. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Name description: Security and compliance search name. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocation description: Security and compliance search OneDrive locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.OneDriveLocationExclusion description: Security and compliance search OneDrive locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocation description: Security and compliance search public folder locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.PublicFolderLocationExclusion description: Security and compliance search public folder locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunBy description: Security and compliance search last run by UPN (Email representation). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.RunspaceId description: Security and compliance search run space ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SharePointLocation description: Security and compliance search SharePoint locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Size description: Security and compliance search bytes results size. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.Status description: Security and compliance search status. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.TenantId description: Security and compliance search Tenant ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Location description: Security and compliance search result location. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.ItemsCount description: The number of security and compliance search results in location. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SuccessResults.Size description: The byte size of the security and compliance search results in location. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.Search.SearchStatus description: The status indicating whether or not the search for a given search_name was successful. type: String - arguments: - description: The name of the compliance search. name: search_name required: true description: Starts stopped, completed, or not started compliance search in the Security & Compliance Center. name: o365-sc-start-search - description: Stop running compliance search in the Security & Compliance Center. name: o365-sc-stop-search arguments: - description: The name of the compliance search. name: search_name required: true - arguments: - description: The name of the compliance search. name: search_name required: true - description: 'Search action to perform. Possible values are: "Preview" and "Purge". Default is "Preview".' name: action defaultValue: "Preview" auto: PREDEFINED predefined: - "Preview" - "Purge" - description: 'Purge type. Possible values are: "Soft Delete" and "HardDelete". Default is "SoftDelete".' name: purge_type auto: PREDEFINED defaultValue: "SoftDelete" predefined: - 'SoftDelete' - 'HardDelete' - description: 'Specifies how to export SharePoint and OneDrive search results. IndividualMessage: Export the files uncompressed. This is the default value. PerUserZip: One ZIP file for each user. Each ZIP file contains the exported files for the user. SingleZip: One ZIP file for all users. The ZIP file contains all exported files from all users. This output setting is available only in PowerShell. To specify the format for Exchange search results, use the exchange_archive_format parameter.' name: share_point_archive_format auto: PREDEFINED predefined: - 'IndividualMessage' - 'PerUserZip' - 'SingleZip' deprecated: true - description: "Specifies the format of the search results when you use the Export action. Valid values are: FxStream: Export to PST files. This is the only option that's available when you export search results from the Microsoft Purview compliance portal. Mime: Export to .eml message files. This is the default value when you use cmdlets to export the search results. Msg: Export to .msg message files." name: format auto: PREDEFINED predefined: - 'FxStream' - 'Mime' - 'Msg' deprecated: true - description: Specifies whether to export previous versions of the document when you use the Export action. name: include_sharepoint_document_versions auto: PREDEFINED predefined: - 'true' - 'false' deprecated: true - description: Specifies the email address target for the search results when you use the Export action. name: notify_email deprecated: true - description: Specifies the cc email address target for the search results when you use the Export action. name: notify_email_cc deprecated: true - description: Specifies the scenario type when you use the Export action. name: scenario auto: PREDEFINED predefined: - 'AnalyzeWithZoom' - 'General' - 'GenerateReportsOnly' - 'Inventory' - 'RetentionReports' - 'TriagePreview' deprecated: true - description: Specifies the items to include when the action is Export. name: scope auto: PREDEFINED deprecated: true predefined: - 'IndexedItemsOnly' - 'UnindexedItemsOnly' - 'BothIndexedAndUnindexedItems' description: After you create a content search using the o365-sc-new-search command and run it using the o365-sc-start-search command, you assign a search action to the search using the o365-sc-new-search-action command. name: o365-sc-new-search-action outputs: - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action description: Security and compliance search action type. Either "Purge" or "Preview". type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled description: Whether to include mailboxes other than regular user mailboxes in the compliance search. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled description: Whether the Azure Batch Framework is enabled for job processing. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId description: Identity of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName description: Name of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy description: Security and compliance search action creator. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime description: Security and compliance search action creation time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description description: Security and compliance search action description. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors description: Security and compliance search action errors. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId description: Security and compliance search action job ID estimation. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId description: Security and compliance search action run ID estimation. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation description: Security and compliance search action exchange locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion description: Security and compliance search action exchange locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity description: Security and compliance search action identity. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid description: Whether the security and compliance search action is valid. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime description: Security and compliance search action job end time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId description: Security and compliance search action job ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId description: Security and compliance search action job run ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime description: Security and compliance search action job start time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime description: Security and compliance search action last modified time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name description: Security and compliance search action name. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation description: Security and compliance search action public folder locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion description: Security and compliance search action public folder locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry description: Whether to retry if the search action failed. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy description: Security and compliance search action run by UPN (email address). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId description: Security and compliance search action run space ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName description: Security and compliance search action search name. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation description: Security and compliance search action SharePoint locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion description: Security and compliance search action SharePoint locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status description: Security and compliance search action status. Either "Started" or "Completed". type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId description: Security and compliance search action Tenant ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchStatus description: The status indicating whether or not the search for a given search_name was successful. type: String - arguments: - description: The name of the compliance search action. name: search_action_name required: true description: Removes a compliance search action by searching for the action name in the Security & Compliance Center. name: o365-sc-remove-search-action - description: Lists compliance search actions from the Security & Compliance Center. name: o365-sc-list-search-action outputs: - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action description: Security and compliance search action type. Either "Purge or "Preview". type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled description: Whether to include mailboxes other than regular user mailboxes in the compliance search. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled description: Whether the Azure Batch Framework is enabled for job processing. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId description: Identity of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName description: Name of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy description: Security and compliance search action creator. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime description: Security and compliance search action creation time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description description: Security and compliance search action description. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors description: Security and compliance search action errors. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId description: Security and compliance search action job ID estimation. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId description: Security and compliance search action run ID estimation. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation description: Security and compliance search action exchange locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion description: Security and compliance search action exchange locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity description: Security and compliance search action identity. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid description: Whether the security and compliance search action is valid. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime description: Security and compliance search action job end time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId description: Security and compliance search action job ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId description: Security and compliance search action job run ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime description: Security and compliance search action job start time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime description: Security and compliance search action last modified time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name description: Security and compliance search action name. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation description: Security and compliance search action public folder locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion description: Security and compliance search action public folder locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry description: Whether to retry if the search action failed. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy description: Security and compliance search action run by UPN (email address). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId description: Security and compliance search action run space ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName description: Security and compliance search action search name. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation description: Security and compliance search action SharePoint locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion description: Security and compliance search action SharePoint locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status description: Security and compliance search action status (Started/Completed). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId description: Security and compliance search action Tenant ID. type: String arguments: [] - arguments: - description: The name of the compliance search action. name: search_action_name required: true - description: 'The maximum number of results to return. If you want to return all requests that match the query, use "-1" for the value of this argument.' name: limit defaultValue: '100' - description: 'Whether to export search results as json file to war-room.' name: export auto: PREDEFINED defaultValue: 'false' predefined: - 'true' - 'false' - description: Whether to print the results in the War Room. Default is "false". name: results auto: PREDEFINED defaultValue: 'false' predefined: - 'true' - 'false' description: Gets compliance search action from the Security & Compliance Center. name: o365-sc-get-search-action outputs: - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Action description: Security and compliance search action type. Either "Purge" or "Preview". type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AllowNotFoundExchangeLocationsEnabled description: Whether to include mailboxes other than regular user mailboxes in the compliance search. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.AzureBatchFrameworkEnabled description: Whether the Azure Batch Framework is enabled for job processing. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseId description: Identity of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CaseName description: Name of a Core eDiscovery case which is associated with the compliance search. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedBy description: Security and compliance search action creator. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.CreatedTime description: Security and compliance search action creation time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Description description: Security and compliance search action description. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Errors description: Security and compliance search action errors. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchJobId description: Security and compliance search action job ID estimation. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.EstimateSearchRunId description: Security and compliance search action run ID estimation. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocation description: Security and compliance search action exchange locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.ExchangeLocationExclusion description: Security and compliance search action exchange locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Identity description: Security and compliance search action identity. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.IsValid description: Whether the security and compliance search action is valid. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobEndTime description: Security and compliance search action job end time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobId description: Security and compliance search action job ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobRunId description: Security and compliance search action job run ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.JobStartTime description: Security and compliance search action job start time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.LastModifiedTime description: Security and compliance search action last modified time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Name description: Security and compliance search action name. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocation description: Security and compliance search action public folder locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.PublicFolderLocationExclusion description: Security and compliance search action public folder locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Location description: Security and compliance search action result location. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ItemCount description: Security and compliance search action result item count. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.TotalSize description: Security and compliance search action result total size. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.FailedCount description: Security and compliance search action result failed count. type: Number - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Sender description: Security and compliance search action result mail sender. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Subject description: Security and compliance search action result subject. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Type description: Security and compliance search action result type. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.Size description: Security and compliance search action result size. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.ReceivedTime description: Security and compliance search action result received time. type: Date - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Results.DataLink description: Security and compliance search action data link. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Retry description: Whether to retry if the search action failed. type: Boolean - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunBy description: Security and compliance search action run by UPN (email address). type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.RunspaceId description: Security and compliance search action run space ID. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SearchName description: Security and compliance search action search name. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocation description: Security and compliance search action SharePoint locations to include. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.SharePointLocationExclusion description: Security and compliance search action SharePoint locations to exclude. type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.Status description: Security and compliance search action status. Either "Started" or "Completed". type: String - contextPath: O365.SecurityAndCompliance.ContentSearch.SearchAction.TenantId description: Security and compliance search action Tenant ID. type: String - name: o365-sc-compliance-case-create description: Create eDiscovery cases in the Microsoft Purview compliance portal. arguments: - name: case_name description: Case name create. required: true - name: case_type description: | "AdvancedEdiscovery: Used to manage legal or other types of investigations. ComplianceClassifier: This type of case corresponds to a trainable classifier. DataInvestigation: Data investigation cases are used to investigate data spillage incidents. DSR: Data Subject Request (DSR) cases are used to manage General Data Protection Regulation (GDPR) DSR investigations. eDiscovery: eDiscovery (also called eDiscovery Standard) cases are used to manage legal or other types of investigations. This is the default value. InsiderRisk: Insider risk cases are used to manage insider risk management cases. Typically, insider risk management cases are manually created in the Microsoft Purview compliance portal to further investigate activity based on a risk alert. SupervisionPolicy: This type of case corresponds to communication compliance policy." defaultValue: "eDiscovery" auto: PREDEFINED predefined: - AdvancedEdiscovery - ComplianceClassifier - DataInvestigation - DSR - eDiscovery - InsiderRisk - SupervisionPolicy - name: description description: Case description. - name: external_id description: Case external ID. outputs: - contextPath: O365.SecurityAndCompliance.ComplianceCase.Name description: Case name. type: String - contextPath: O365.SecurityAndCompliance.ComplianceCase.Status description: Case status. type: String - contextPath: O365.SecurityAndCompliance.ComplianceCase.CreatedDateTime description: Case created date time. type: String - name: o365-sc-compliance-case-list description: List different types of compliance cases in the Microsoft Purview compliance portal. arguments: - name: identity description: List cases by identity. - name: case_type description: Comma-separated closed list of Case Types to filter by. isArray: true auto: PREDEFINED predefined: - AdvancedEdiscovery - ComplianceClassifier - DataInvestigation - DSR - eDiscovery - InsiderRisk - SupervisionPolicy - name: limit description: Limit returned cases list size. defaultValue: '50' outputs: - contextPath: O365.SecurityAndCompliance.ComplianceCase.Name description: Case name. type: String - contextPath: O365.SecurityAndCompliance.ComplianceCase.Status description: Case status. type: String - contextPath: O365.SecurityAndCompliance.ComplianceCase.GUID description: Case GUID. type: UUID - contextPath: O365.SecurityAndCompliance.ComplianceCase.CreatedDateTime description: Case created date time. type: String - name: o365-sc-compliance-case-delete description: Removes compliance cases from the Microsoft Purview compliance portal or the Microsoft Purview compliance portal. arguments: - name: identity description: Delete case by identity. required: true - name: o365-sc-case-hold-policy-create description: Creates new case hold policies in the Microsoft Purview compliance portal. arguments: - name: policy_name description: Name of the policy to create. required: true - name: case description: eDiscovery case, Case Name, Case Identity (GUID value). required: true - name: comment description: Attach a comment to the case. - name: exchange_location description: Mailbox or distribution group. isArray: true - name: public_folder_location description: Comma-separated list of public folders to include, or you can use the value "All" to include all. isArray: true - name: share_point_location description: SharePoint Online and OneDrive for Business sites to include. isArray: true - name: enabled description: Set hold policy as enabled or not. auto: PREDEFINED defaultValue: 'true' predefined: - 'true' - 'false' outputs: - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Name description: Case hold policy name. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Workload description: Case hold policy workload. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Enabled description: Is case hold policy enabled. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Mode description: Case hold policy mode. type: String - name: o365-sc-case-hold-policy-get description: View existing case hold policies in the Microsoft Purview compliance portal. arguments: - name: identity description: Identity of the case hold policy to get. - name: case description: Case of policy to get. Case name or case GUID. - name: distribution_detail description: Whether to include distribution details or not. auto: PREDEFINED defaultValue: 'true' predefined: - 'true' - 'false' - name: include_bindings description: Whether to include bindings or not. auto: PREDEFINED defaultValue: 'true' predefined: - 'true' - 'false' outputs: - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Name description: Case hold policy name. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.GUID description: Case hold policy GUID. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Workload description: Case hold policy workload. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Status description: Case hold policy status. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldPolicy.Mode description: Case hold policy mode. type: String - name: o365-sc-case-hold-policy-delete description: Removes case hold policies from the Microsoft Purview compliance portal. arguments: - name: identity description: Identify of the case hold policy to delete. required: true - name: force_delete description: Whether to use force delete or not. Can be used if current policy status is pending delete. auto: PREDEFINED defaultValue: 'false' predefined: - 'true' - 'false' - name: o365-sc-case-hold-rule-create description: Creates new case hold rules in the Microsoft Purview compliance portal. arguments: - name: rule_name description: Create rule with the specified name. required: true - name: policy_name description: Create rule for the specified policy. required: true - name: query description: Query using Keyword Query Language (KQL). - name: comment description: Attach a comment to the created rule. - name: is_disabled description: Whether the rule is disabled or not. auto: PREDEFINED defaultValue: 'false' predefined: - 'true' - 'false' outputs: - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Name description: Case hold policy name. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Status description: Case hold policy status. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Mode description: Case hold policy mode. type: String - name: o365-sc-case-hold-rule-list description: View case hold rules in the Microsoft Purview compliance portal. arguments: - name: identity description: Get hold rule list by identity. - name: policy description: Get hold rule list by policy. - name: limit description: Limit the returned items list size. defaultValue: '50' outputs: - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Name description: Case hold policy name. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldRule.GUID description: Case hold policy GUID. type: UUID - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Enabled description: Whether case hold policy is enabled. type: String - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Mode description: Case hold policy mode. type: String - name: o365-sc-case-hold-rule-delete description: Removes case hold rules from the Microsoft Purview compliance portal. arguments: - name: identity description: Delete rule by identity. - name: force_delete description: Whether to use force delete or not. Can be used if current rule status is pending delete. auto: PREDEFINED defaultValue: 'false' predefined: - 'true' - 'false' - arguments: - description: Identity of the policy to update. name: identity required: true - description: Exchange locations to add to the policy. isArray: true name: add_exchange_locations - description: Sharepoint locations to add to the policy. isArray: true name: add_sharepoint_locations - description: Public locations to add to the policy. isArray: true name: add_public_locations - description: Exchange locations to remove from the policy. isArray: true name: remove_exchange_locations - description: Sharepoint locations to remove from the policy. isArray: true name: remove_sharepoint_locations - description: Public locations to remove from the policy. isArray: true name: remove_public_locations - description: Add a comment to existing policy. name: comment - auto: PREDEFINED defaultValue: 'true' description: Enable or disable the policy. name: enabled predefined: - 'true' - 'false' description: Update inputs for case hold policies. name: o365-sc-case-hold-policy-set - name: o365-sc-email-security-search-and-delete-email-office-365-quick-action prettyname: "[Email Security] Search And Delete Email - Office 365" hidden: true quickaction: true polling: true description: Deletes an email for all recipients. arguments: - name: internet_message_id description: The unique identifier of the email message, e.g., . required: true prettyname: Internet message ID auto: PREDEFINED prettypredefined: Issue Internet message ID: ${issue.xdmemailmessageid} - name: exchange_location prettyname: Exchange Location description: Comma-separated list of mailboxes or groups. Use "All" to target everyone (may be slow). isArray: true defaultValue: 'All' auto: PREDEFINED prettypredefined: All: 'All' - name: force prettyname: Force description: If true, creates a new search even if one already exists. defaultValue: 'false' auto: PREDEFINED predefined: - 'false' - 'true' - name: polling_first_run description: For polling use. defaultValue: true hidden: true - name: search_name description: For polling use. hidden: true outputs: - contextPath: O365.SecurityAndCompliance.CaseHoldRule.Name description: Case hold policy name. type: String dockerimage: demisto/pwsh-exchangev3:1.0.0.4904712 runonce: true script: '' type: powershell fromversion: 5.5.0 supportsquickactions: true tests: - No tests (deprecated) autoUpdateDockerImage: false