Edit

ediscoverySearch resource type

  • Article

Namespace: microsoft.graph.security

Represents an eDiscovery search. For details, see Collect data for a case in eDiscovery (Premium).

Methods

Method Return type Description
List ediscoverySearches microsoft.graph.security.ediscoverySearch collection Get a list of the ediscoverySearch objects and their properties.
Create ediscoverySearch microsoft.graph.security.ediscoverySearch Create a new ediscoverySearch object.
Get ediscoverySearch microsoft.graph.security.ediscoverySearch Read the properties and relationships of an ediscoverySearch object.
Update ediscoverySearch microsoft.graph.security.ediscoverySearch Update the properties of an ediscoverySearch object.
Delete ediscoverySearch None Delete an microsoft.graph.security.ediscoverySearch object.
estimateStatistics None Run an estimate statistics operation on the data contained in the eDiscovery search.
List additionalSources microsoft.graph.security.dataSource collection Get the list of additional sources associated with an eDiscovery search.
Add additionalSources microsoft.graph.security.dataSource Create a new additional source associated with an eDiscovery search.
List ediscoveryEstimateOperation microsoft.graph.security.ediscoveryEstimateOperation collection Get the last ediscoveryEstimateOperation objects and their properties.
List custodianSources microsoft.graph.security.dataSource collection Get the list of custodial data sources associated with an eDiscovery search.
Add custodianSources microsoft.graph.security.dataSource Create a new custodian source associated with an eDiscovery search.
Remove custodianSources None Remove a microsoft.graph.security.dataSource object.
List noncustodialSources microsoft.graph.security.ediscoveryNoncustodialDataSource collection Get the list of non-custodialSources associated with an eDiscovery search.
Add noncustodialSources microsoft.graph.security.ediscoveryNoncustodialDataSource Create a new non-custodial source associated with an eDiscovery search.
Remove noncustodialSources None Remove an microsoft.graph.security.ediscoveryNoncustodialDataSource object.

Properties

Property Type Description
contentQuery String The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
createdBy identitySet The user who created the eDiscovery search.
createdDateTime DateTimeOffset The date and time the eDiscovery search was created.
dataSourceScopes microsoft.graph.security.dataSourceScopes When specified, the collection will span across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources.
description String The description of the eDiscovery search.
displayName String The display name of the eDiscovery search.
id String The ID for the eDiscovery search. Read-only.
lastModifiedBy identitySet The last user who modified the eDiscovery search.
lastModifiedDateTime DateTimeOffset The last date and time the eDiscovery search was modified.

dataSourceScopes values

Member Description
none Do not specify any scopes - locations would be referenced separately.
allTenantMailboxes Include all tenant mailboxes in the eDiscovery search.
allTenantSites Include all tenant sites in the eDiscovery search.
allCaseCustodians Include all custodian locations in the eDiscovery search.
allCaseNoncustodialDataSources Include all non-custodial data sources in the eDiscovery search.

Relationships

Relationship Type Description
additionalSources microsoft.graph.security.dataSource collection Adds an additional source to the eDiscovery search.
addToReviewSetOperation microsoft.graph.security.ediscoveryAddToReviewSetOperation Adds the results of the eDiscovery search to the specified reviewSet.
custodianSources microsoft.graph.security.dataSource collection Custodian sources that are included in the eDiscovery search.
lastEstimateStatisticsOperation microsoft.graph.security.ediscoveryEstimateOperation The last estimate operation associated with the eDiscovery search.
noncustodialSources microsoft.graph.security.ediscoveryNoncustodialDataSource collection noncustodialDataSource sources that are included in the eDiscovery search

JSON representation

The following is a JSON representation of the resource.

{
  "@odata.type": "#microsoft.graph.security.ediscoverySearch",
  "id": "String (identifier)",
  "displayName": "String",
  "description": "String",
  "createdBy": {
    "@odata.type": "microsoft.graph.identitySet"
  },
  "createdDateTime": "String (timestamp)",
  "lastModifiedBy": {
    "@odata.type": "microsoft.graph.identitySet"
  },
  "lastModifiedDateTime": "String (timestamp)",
  "contentQuery": "String",
  "dataSourceScopes": "String"
}