Update-MgSecurityCaseEdiscoveryCaseSearch
Update the properties of an ediscoverySearch object.
Note
To view the beta release of this cmdlet, view Update-MgBetaSecurityCaseEdiscoveryCaseSearch
Syntax
Update-MgSecurityCaseEdiscoveryCaseSearch
-EdiscoveryCaseId <String>
-EdiscoverySearchId <String>
[-ResponseHeadersVariable <String>]
[-AddToReviewSetOperation <IMicrosoftGraphSecurityEdiscoveryAddToReviewSetOperation>]
[-AdditionalProperties <Hashtable>]
[-AdditionalSources <IMicrosoftGraphSecurityDataSource[]>]
[-ContentQuery <String>]
[-CreatedBy <IMicrosoftGraphIdentitySet>]
[-CreatedDateTime <DateTime>]
[-CustodianSources <IMicrosoftGraphSecurityDataSource[]>]
[-DataSourceScopes <String>]
[-Description <String>]
[-DisplayName <String>]
[-Id <String>]
[-LastEstimateStatisticsOperation <IMicrosoftGraphSecurityEdiscoveryEstimateOperation>]
[-LastModifiedBy <IMicrosoftGraphIdentitySet>]
[-LastModifiedDateTime <DateTime>]
[-NoncustodialSources <IMicrosoftGraphSecurityEdiscoveryNoncustodialDataSource[]>]
[-Headers <IDictionary>]
[-ProgressAction <ActionPreference>]
[-WhatIf]
[-Confirm]
[<CommonParameters>] Update-MgSecurityCaseEdiscoveryCaseSearch
-EdiscoveryCaseId <String>
-EdiscoverySearchId <String>
-BodyParameter <IMicrosoftGraphSecurityEdiscoverySearch>
[-ResponseHeadersVariable <String>]
[-Headers <IDictionary>]
[-ProgressAction <ActionPreference>]
[-WhatIf]
[-Confirm]
[<CommonParameters>] Update-MgSecurityCaseEdiscoveryCaseSearch
-InputObject <ISecurityIdentity>
[-ResponseHeadersVariable <String>]
[-AddToReviewSetOperation <IMicrosoftGraphSecurityEdiscoveryAddToReviewSetOperation>]
[-AdditionalProperties <Hashtable>]
[-AdditionalSources <IMicrosoftGraphSecurityDataSource[]>]
[-ContentQuery <String>]
[-CreatedBy <IMicrosoftGraphIdentitySet>]
[-CreatedDateTime <DateTime>]
[-CustodianSources <IMicrosoftGraphSecurityDataSource[]>]
[-DataSourceScopes <String>]
[-Description <String>]
[-DisplayName <String>]
[-Id <String>]
[-LastEstimateStatisticsOperation <IMicrosoftGraphSecurityEdiscoveryEstimateOperation>]
[-LastModifiedBy <IMicrosoftGraphIdentitySet>]
[-LastModifiedDateTime <DateTime>]
[-NoncustodialSources <IMicrosoftGraphSecurityEdiscoveryNoncustodialDataSource[]>]
[-Headers <IDictionary>]
[-ProgressAction <ActionPreference>]
[-WhatIf]
[-Confirm]
[<CommonParameters>] Update-MgSecurityCaseEdiscoveryCaseSearch
-InputObject <ISecurityIdentity>
-BodyParameter <IMicrosoftGraphSecurityEdiscoverySearch>
[-ResponseHeadersVariable <String>]
[-Headers <IDictionary>]
[-ProgressAction <ActionPreference>]
[-WhatIf]
[-Confirm]
[<CommonParameters>] Description
Update the properties of an ediscoverySearch object.
Examples
Example 1: Code snippet
Import-Module Microsoft.Graph.Security
$params = @{
displayName = "Teams search"
}
Update-MgSecurityCaseEdiscoveryCaseSearch -EdiscoveryCaseId $ediscoveryCaseId -EdiscoverySearchId $ediscoverySearchId -BodyParameter $paramsThis example shows how to use the Update-MgSecurityCaseEdiscoveryCaseSearch Cmdlet.
Parameters
-AdditionalProperties
Additional Parameters
| Type: | Hashtable |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-AdditionalSources
Adds an additional source to the eDiscovery search. To construct, see NOTES section for ADDITIONALSOURCES properties and create a hash table.
| Type: | IMicrosoftGraphSecurityDataSource[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-AddToReviewSetOperation
ediscoveryAddToReviewSetOperation To construct, see NOTES section for ADDTOREVIEWSETOPERATION properties and create a hash table.
| Type: | IMicrosoftGraphSecurityEdiscoveryAddToReviewSetOperation |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-BodyParameter
ediscoverySearch To construct, see NOTES section for BODYPARAMETER properties and create a hash table.
| Type: | IMicrosoftGraphSecurityEdiscoverySearch |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-Confirm
Prompts you for confirmation before running the cmdlet.
| Type: | SwitchParameter |
| Aliases: | cf |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ContentQuery
.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-CreatedBy
identitySet To construct, see NOTES section for CREATEDBY properties and create a hash table.
| Type: | IMicrosoftGraphIdentitySet |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-CreatedDateTime
.
| Type: | DateTime |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-CustodianSources
Custodian sources that are included in the eDiscovery search. To construct, see NOTES section for CUSTODIANSOURCES properties and create a hash table.
| Type: | IMicrosoftGraphSecurityDataSource[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DataSourceScopes
dataSourceScopes
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Description
.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DisplayName
.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EdiscoveryCaseId
The unique identifier of ediscoveryCase
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EdiscoverySearchId
The unique identifier of ediscoverySearch
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Headers
Optional headers that will be added to the request.
| Type: | IDictionary |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-Id
The unique identifier for an entity. Read-only.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-InputObject
Identity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.
| Type: | ISecurityIdentity |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-LastEstimateStatisticsOperation
ediscoveryEstimateOperation To construct, see NOTES section for LASTESTIMATESTATISTICSOPERATION properties and create a hash table.
| Type: | IMicrosoftGraphSecurityEdiscoveryEstimateOperation |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-LastModifiedBy
identitySet To construct, see NOTES section for LASTMODIFIEDBY properties and create a hash table.
| Type: | IMicrosoftGraphIdentitySet |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-LastModifiedDateTime
.
| Type: | DateTime |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-NoncustodialSources
noncustodialDataSource sources that are included in the eDiscovery search To construct, see NOTES section for NONCUSTODIALSOURCES properties and create a hash table.
| Type: | IMicrosoftGraphSecurityEdiscoveryNoncustodialDataSource[] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ProgressAction
{{ Fill ProgressAction Description }}
| Type: | ActionPreference |
| Aliases: | proga |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ResponseHeadersVariable
Optional Response Headers Variable.
| Type: | String |
| Aliases: | RHV |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
| Type: | SwitchParameter |
| Aliases: | wi |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Inputs
Microsoft.Graph.PowerShell.Models.IMicrosoftGraphSecurityEdiscoverySearch
Microsoft.Graph.PowerShell.Models.ISecurityIdentity
System.Collections.IDictionary
Outputs
Microsoft.Graph.PowerShell.Models.IMicrosoftGraphSecurityEdiscoverySearch
Notes
COMPLEX PARAMETER PROPERTIES
To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.
ADDITIONALSOURCES <IMicrosoftGraphSecurityDataSource- []>: Adds an additional source to the eDiscovery search.
[Id <String>]: The unique identifier for an entity. Read-only.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[(Any) <Object>]: This indicates any property can be added to this object.[Application <IMicrosoftGraphIdentity>]: identity[(Any) <Object>]: This indicates any property can be added to this object.[DisplayName <String>]: The display name of the identity. The display name might not always be available or up to date. For example, if a user changes their display name, the API might show the new value in a future response, but the items associated with the user won't show up as having changed when using delta.[Id <String>]: Unique identifier for the identity.
[Device <IMicrosoftGraphIdentity>]: identity[User <IMicrosoftGraphIdentity>]: identity
[CreatedDateTime <DateTime?>]: The date and time the dataSource was created.[DisplayName <String>]: The display name of the dataSource and is the name of the SharePoint site.[HoldStatus <String>]: dataSourceHoldStatus
ADDTOREVIEWSETOPERATION <IMicrosoftGraphSecurityEdiscoveryAddToReviewSetOperation>: ediscoveryAddToReviewSetOperation
[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[(Any) <Object>]: This indicates any property can be added to this object.[Application <IMicrosoftGraphIdentity>]: identity[(Any) <Object>]: This indicates any property can be added to this object.[DisplayName <String>]: The display name of the identity. The display name might not always be available or up to date. For example, if a user changes their display name, the API might show the new value in a future response, but the items associated with the user won't show up as having changed when using delta.[Id <String>]: Unique identifier for the identity.
[Device <IMicrosoftGraphIdentity>]: identity[User <IMicrosoftGraphIdentity>]: identity
[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[(Any) <Object>]: This indicates any property can be added to this object.[Code <Int32?>]: The result code.[Message <String>]: The message.[Subcode <Int32?>]: The result subcode.
[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.[ReviewSet <IMicrosoftGraphSecurityEdiscoveryReviewSet>]: ediscoveryReviewSet[(Any) <Object>]: This indicates any property can be added to this object.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]:[DisplayName <String>]:[Id <String>]: The unique identifier for an entity. Read-only.[Queries <IMicrosoftGraphSecurityEdiscoveryReviewSetQuery-[]>]: Represents queries within the review set.[ContentQuery <String>]:[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]:[Description <String>]:[DisplayName <String>]:[LastModifiedBy <IMicrosoftGraphIdentitySet>]: identitySet[LastModifiedDateTime <DateTime?>]:[Id <String>]: The unique identifier for an entity. Read-only.
[Search <IMicrosoftGraphSecurityEdiscoverySearch>]: ediscoverySearch[(Any) <Object>]: This indicates any property can be added to this object.[ContentQuery <String>]:[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]:[Description <String>]:[DisplayName <String>]:[LastModifiedBy <IMicrosoftGraphIdentitySet>]: identitySet[LastModifiedDateTime <DateTime?>]:[Id <String>]: The unique identifier for an entity. Read-only.[AddToReviewSetOperation <IMicrosoftGraphSecurityEdiscoveryAddToReviewSetOperation>]: ediscoveryAddToReviewSetOperation[AdditionalSources <IMicrosoftGraphSecurityDataSource-[]>]: Adds an additional source to the eDiscovery search.[Id <String>]: The unique identifier for an entity. Read-only.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the dataSource was created.[DisplayName <String>]: The display name of the dataSource and is the name of the SharePoint site.[HoldStatus <String>]: dataSourceHoldStatus
[CustodianSources <IMicrosoftGraphSecurityDataSource-[]>]: Custodian sources that are included in the eDiscovery search.[DataSourceScopes <String>]: dataSourceScopes[LastEstimateStatisticsOperation <IMicrosoftGraphSecurityEdiscoveryEstimateOperation>]: ediscoveryEstimateOperation[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.[IndexedItemCount <Int64?>]: The estimated count of items for the search that matched the content query.[IndexedItemsSize <Int64?>]: The estimated size of items for the search that matched the content query.[MailboxCount <Int32?>]: The number of mailboxes that had search hits.[Search <IMicrosoftGraphSecurityEdiscoverySearch>]: ediscoverySearch[SiteCount <Int32?>]: The number of mailboxes that had search hits.[UnindexedItemCount <Int64?>]: The estimated count of unindexed items for the collection.[UnindexedItemsSize <Int64?>]: The estimated size of unindexed items for the collection.
[NoncustodialSources <IMicrosoftGraphSecurityEdiscoveryNoncustodialDataSource-[]>]: noncustodialDataSource sources that are included in the eDiscovery search[CreatedDateTime <DateTime?>]: Created date and time of the dataSourceContainer entity.[DisplayName <String>]: Display name of the dataSourceContainer entity.[HoldStatus <String>]: dataSourceHoldStatus[LastModifiedDateTime <DateTime?>]: Last modified date and time of the dataSourceContainer.[ReleasedDateTime <DateTime?>]: Date and time that the dataSourceContainer was released from the case.[Status <String>]: dataSourceContainerStatus[Id <String>]: The unique identifier for an entity. Read-only.[DataSource <IMicrosoftGraphSecurityDataSource>]: dataSource[LastIndexOperation <IMicrosoftGraphSecurityEdiscoveryIndexOperation>]: ediscoveryIndexOperation[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.
BODYPARAMETER <IMicrosoftGraphSecurityEdiscoverySearch>: ediscoverySearch
[(Any) <Object>]: This indicates any property can be added to this object.[ContentQuery <String>]:[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[(Any) <Object>]: This indicates any property can be added to this object.[Application <IMicrosoftGraphIdentity>]: identity[(Any) <Object>]: This indicates any property can be added to this object.[DisplayName <String>]: The display name of the identity. The display name might not always be available or up to date. For example, if a user changes their display name, the API might show the new value in a future response, but the items associated with the user won't show up as having changed when using delta.[Id <String>]: Unique identifier for the identity.
[Device <IMicrosoftGraphIdentity>]: identity[User <IMicrosoftGraphIdentity>]: identity
[CreatedDateTime <DateTime?>]:[Description <String>]:[DisplayName <String>]:[LastModifiedBy <IMicrosoftGraphIdentitySet>]: identitySet[LastModifiedDateTime <DateTime?>]:[Id <String>]: The unique identifier for an entity. Read-only.[AddToReviewSetOperation <IMicrosoftGraphSecurityEdiscoveryAddToReviewSetOperation>]: ediscoveryAddToReviewSetOperation[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[(Any) <Object>]: This indicates any property can be added to this object.[Code <Int32?>]: The result code.[Message <String>]: The message.[Subcode <Int32?>]: The result subcode.
[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.[ReviewSet <IMicrosoftGraphSecurityEdiscoveryReviewSet>]: ediscoveryReviewSet[(Any) <Object>]: This indicates any property can be added to this object.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]:[DisplayName <String>]:[Id <String>]: The unique identifier for an entity. Read-only.[Queries <IMicrosoftGraphSecurityEdiscoveryReviewSetQuery-[]>]: Represents queries within the review set.[ContentQuery <String>]:[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]:[Description <String>]:[DisplayName <String>]:[LastModifiedBy <IMicrosoftGraphIdentitySet>]: identitySet[LastModifiedDateTime <DateTime?>]:[Id <String>]: The unique identifier for an entity. Read-only.
[Search <IMicrosoftGraphSecurityEdiscoverySearch>]: ediscoverySearch
[AdditionalSources <IMicrosoftGraphSecurityDataSource-[]>]: Adds an additional source to the eDiscovery search.[Id <String>]: The unique identifier for an entity. Read-only.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the dataSource was created.[DisplayName <String>]: The display name of the dataSource and is the name of the SharePoint site.[HoldStatus <String>]: dataSourceHoldStatus
[CustodianSources <IMicrosoftGraphSecurityDataSource-[]>]: Custodian sources that are included in the eDiscovery search.[DataSourceScopes <String>]: dataSourceScopes[LastEstimateStatisticsOperation <IMicrosoftGraphSecurityEdiscoveryEstimateOperation>]: ediscoveryEstimateOperation[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.[IndexedItemCount <Int64?>]: The estimated count of items for the search that matched the content query.[IndexedItemsSize <Int64?>]: The estimated size of items for the search that matched the content query.[MailboxCount <Int32?>]: The number of mailboxes that had search hits.[Search <IMicrosoftGraphSecurityEdiscoverySearch>]: ediscoverySearch[SiteCount <Int32?>]: The number of mailboxes that had search hits.[UnindexedItemCount <Int64?>]: The estimated count of unindexed items for the collection.[UnindexedItemsSize <Int64?>]: The estimated size of unindexed items for the collection.
[NoncustodialSources <IMicrosoftGraphSecurityEdiscoveryNoncustodialDataSource-[]>]: noncustodialDataSource sources that are included in the eDiscovery search[CreatedDateTime <DateTime?>]: Created date and time of the dataSourceContainer entity.[DisplayName <String>]: Display name of the dataSourceContainer entity.[HoldStatus <String>]: dataSourceHoldStatus[LastModifiedDateTime <DateTime?>]: Last modified date and time of the dataSourceContainer.[ReleasedDateTime <DateTime?>]: Date and time that the dataSourceContainer was released from the case.[Status <String>]: dataSourceContainerStatus[Id <String>]: The unique identifier for an entity. Read-only.[DataSource <IMicrosoftGraphSecurityDataSource>]: dataSource[LastIndexOperation <IMicrosoftGraphSecurityEdiscoveryIndexOperation>]: ediscoveryIndexOperation[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.
CREATEDBY <IMicrosoftGraphIdentitySet>: identitySet
[(Any) <Object>]: This indicates any property can be added to this object.[Application <IMicrosoftGraphIdentity>]: identity[(Any) <Object>]: This indicates any property can be added to this object.[DisplayName <String>]: The display name of the identity. The display name might not always be available or up to date. For example, if a user changes their display name, the API might show the new value in a future response, but the items associated with the user won't show up as having changed when using delta.[Id <String>]: Unique identifier for the identity.
[Device <IMicrosoftGraphIdentity>]: identity[User <IMicrosoftGraphIdentity>]: identity
CUSTODIANSOURCES <IMicrosoftGraphSecurityDataSource- []>: Custodian sources that are included in the eDiscovery search.
[Id <String>]: The unique identifier for an entity. Read-only.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[(Any) <Object>]: This indicates any property can be added to this object.[Application <IMicrosoftGraphIdentity>]: identity[(Any) <Object>]: This indicates any property can be added to this object.[DisplayName <String>]: The display name of the identity. The display name might not always be available or up to date. For example, if a user changes their display name, the API might show the new value in a future response, but the items associated with the user won't show up as having changed when using delta.[Id <String>]: Unique identifier for the identity.
[Device <IMicrosoftGraphIdentity>]: identity[User <IMicrosoftGraphIdentity>]: identity
[CreatedDateTime <DateTime?>]: The date and time the dataSource was created.[DisplayName <String>]: The display name of the dataSource and is the name of the SharePoint site.[HoldStatus <String>]: dataSourceHoldStatus
INPUTOBJECT <ISecurityIdentity>: Identity Parameter
[AlertId <String>]: The unique identifier of alert[ArticleId <String>]: The unique identifier of article[ArticleIndicatorId <String>]: The unique identifier of articleIndicator[AttackSimulationOperationId <String>]: The unique identifier of attackSimulationOperation[AuthoredNoteId <String>]: The unique identifier of authoredNote[AuthorityTemplateId <String>]: The unique identifier of authorityTemplate[CaseOperationId <String>]: The unique identifier of caseOperation[CategoryTemplateId <String>]: The unique identifier of categoryTemplate[CitationTemplateId <String>]: The unique identifier of citationTemplate[DataSourceId <String>]: The unique identifier of dataSource[DepartmentTemplateId <String>]: The unique identifier of departmentTemplate[DispositionReviewStageNumber <String>]: The unique identifier of dispositionReviewStage[EdiscoveryCaseId <String>]: The unique identifier of ediscoveryCase[EdiscoveryCustodianId <String>]: The unique identifier of ediscoveryCustodian[EdiscoveryNoncustodialDataSourceId <String>]: The unique identifier of ediscoveryNoncustodialDataSource[EdiscoveryReviewSetId <String>]: The unique identifier of ediscoveryReviewSet[EdiscoveryReviewSetQueryId <String>]: The unique identifier of ediscoveryReviewSetQuery[EdiscoveryReviewTagId <String>]: The unique identifier of ediscoveryReviewTag[EdiscoveryReviewTagId1 <String>]: The unique identifier of ediscoveryReviewTag[EdiscoverySearchId <String>]: The unique identifier of ediscoverySearch[EndUserNotificationDetailId <String>]: The unique identifier of endUserNotificationDetail[EndUserNotificationId <String>]: The unique identifier of endUserNotification[FilePlanReferenceTemplateId <String>]: The unique identifier of filePlanReferenceTemplate[HostComponentId <String>]: The unique identifier of hostComponent[HostCookieId <String>]: The unique identifier of hostCookie[HostId <String>]: The unique identifier of host[HostPairId <String>]: The unique identifier of hostPair[HostPortId <String>]: The unique identifier of hostPort[HostSslCertificateId <String>]: The unique identifier of hostSslCertificate[HostTrackerId <String>]: The unique identifier of hostTracker[IncidentId <String>]: The unique identifier of incident[IntelligenceProfileId <String>]: The unique identifier of intelligenceProfile[IntelligenceProfileIndicatorId <String>]: The unique identifier of intelligenceProfileIndicator[LandingPageDetailId <String>]: The unique identifier of landingPageDetail[LandingPageId <String>]: The unique identifier of landingPage[LoginPageId <String>]: The unique identifier of loginPage[PassiveDnsRecordId <String>]: The unique identifier of passiveDnsRecord[PayloadId <String>]: The unique identifier of payload[RetentionEventId <String>]: The unique identifier of retentionEvent[RetentionEventTypeId <String>]: The unique identifier of retentionEventType[RetentionLabelId <String>]: The unique identifier of retentionLabel[SecureScoreControlProfileId <String>]: The unique identifier of secureScoreControlProfile[SecureScoreId <String>]: The unique identifier of secureScore[SimulationAutomationId <String>]: The unique identifier of simulationAutomation[SimulationAutomationRunId <String>]: The unique identifier of simulationAutomationRun[SimulationId <String>]: The unique identifier of simulation[SiteSourceId <String>]: The unique identifier of siteSource[SslCertificateId <String>]: The unique identifier of sslCertificate[SubcategoryTemplateId <String>]: The unique identifier of subcategoryTemplate[SubdomainId <String>]: The unique identifier of subdomain[SubjectRightsRequestId <String>]: The unique identifier of subjectRightsRequest[TrainingId <String>]: The unique identifier of training[TrainingLanguageDetailId <String>]: The unique identifier of trainingLanguageDetail[UnifiedGroupSourceId <String>]: The unique identifier of unifiedGroupSource[UserId <String>]: The unique identifier of user[UserSourceId <String>]: The unique identifier of userSource[VulnerabilityComponentId <String>]: The unique identifier of vulnerabilityComponent[VulnerabilityId <String>]: The unique identifier of vulnerability[WhoisHistoryRecordId <String>]: The unique identifier of whoisHistoryRecord[WhoisRecordId <String>]: The unique identifier of whoisRecord
LASTESTIMATESTATISTICSOPERATION <IMicrosoftGraphSecurityEdiscoveryEstimateOperation>: ediscoveryEstimateOperation
[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[(Any) <Object>]: This indicates any property can be added to this object.[Application <IMicrosoftGraphIdentity>]: identity[(Any) <Object>]: This indicates any property can be added to this object.[DisplayName <String>]: The display name of the identity. The display name might not always be available or up to date. For example, if a user changes their display name, the API might show the new value in a future response, but the items associated with the user won't show up as having changed when using delta.[Id <String>]: Unique identifier for the identity.
[Device <IMicrosoftGraphIdentity>]: identity[User <IMicrosoftGraphIdentity>]: identity
[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[(Any) <Object>]: This indicates any property can be added to this object.[Code <Int32?>]: The result code.[Message <String>]: The message.[Subcode <Int32?>]: The result subcode.
[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.[IndexedItemCount <Int64?>]: The estimated count of items for the search that matched the content query.[IndexedItemsSize <Int64?>]: The estimated size of items for the search that matched the content query.[MailboxCount <Int32?>]: The number of mailboxes that had search hits.[Search <IMicrosoftGraphSecurityEdiscoverySearch>]: ediscoverySearch[(Any) <Object>]: This indicates any property can be added to this object.[ContentQuery <String>]:[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]:[Description <String>]:[DisplayName <String>]:[LastModifiedBy <IMicrosoftGraphIdentitySet>]: identitySet[LastModifiedDateTime <DateTime?>]:[Id <String>]: The unique identifier for an entity. Read-only.[AddToReviewSetOperation <IMicrosoftGraphSecurityEdiscoveryAddToReviewSetOperation>]: ediscoveryAddToReviewSetOperation[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.[ReviewSet <IMicrosoftGraphSecurityEdiscoveryReviewSet>]: ediscoveryReviewSet[(Any) <Object>]: This indicates any property can be added to this object.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]:[DisplayName <String>]:[Id <String>]: The unique identifier for an entity. Read-only.[Queries <IMicrosoftGraphSecurityEdiscoveryReviewSetQuery-[]>]: Represents queries within the review set.[ContentQuery <String>]:[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]:[Description <String>]:[DisplayName <String>]:[LastModifiedBy <IMicrosoftGraphIdentitySet>]: identitySet[LastModifiedDateTime <DateTime?>]:[Id <String>]: The unique identifier for an entity. Read-only.
[Search <IMicrosoftGraphSecurityEdiscoverySearch>]: ediscoverySearch
[AdditionalSources <IMicrosoftGraphSecurityDataSource-[]>]: Adds an additional source to the eDiscovery search.[Id <String>]: The unique identifier for an entity. Read-only.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the dataSource was created.[DisplayName <String>]: The display name of the dataSource and is the name of the SharePoint site.[HoldStatus <String>]: dataSourceHoldStatus
[CustodianSources <IMicrosoftGraphSecurityDataSource-[]>]: Custodian sources that are included in the eDiscovery search.[DataSourceScopes <String>]: dataSourceScopes[LastEstimateStatisticsOperation <IMicrosoftGraphSecurityEdiscoveryEstimateOperation>]: ediscoveryEstimateOperation[NoncustodialSources <IMicrosoftGraphSecurityEdiscoveryNoncustodialDataSource-[]>]: noncustodialDataSource sources that are included in the eDiscovery search[CreatedDateTime <DateTime?>]: Created date and time of the dataSourceContainer entity.[DisplayName <String>]: Display name of the dataSourceContainer entity.[HoldStatus <String>]: dataSourceHoldStatus[LastModifiedDateTime <DateTime?>]: Last modified date and time of the dataSourceContainer.[ReleasedDateTime <DateTime?>]: Date and time that the dataSourceContainer was released from the case.[Status <String>]: dataSourceContainerStatus[Id <String>]: The unique identifier for an entity. Read-only.[DataSource <IMicrosoftGraphSecurityDataSource>]: dataSource[LastIndexOperation <IMicrosoftGraphSecurityEdiscoveryIndexOperation>]: ediscoveryIndexOperation[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.
[SiteCount <Int32?>]: The number of mailboxes that had search hits.[UnindexedItemCount <Int64?>]: The estimated count of unindexed items for the collection.[UnindexedItemsSize <Int64?>]: The estimated size of unindexed items for the collection.
LASTMODIFIEDBY <IMicrosoftGraphIdentitySet>: identitySet
[(Any) <Object>]: This indicates any property can be added to this object.[Application <IMicrosoftGraphIdentity>]: identity[(Any) <Object>]: This indicates any property can be added to this object.[DisplayName <String>]: The display name of the identity. The display name might not always be available or up to date. For example, if a user changes their display name, the API might show the new value in a future response, but the items associated with the user won't show up as having changed when using delta.[Id <String>]: Unique identifier for the identity.
[Device <IMicrosoftGraphIdentity>]: identity[User <IMicrosoftGraphIdentity>]: identity
NONCUSTODIALSOURCES <IMicrosoftGraphSecurityEdiscoveryNoncustodialDataSource- []>: noncustodialDataSource sources that are included in the eDiscovery search
[CreatedDateTime <DateTime?>]: Created date and time of the dataSourceContainer entity.[DisplayName <String>]: Display name of the dataSourceContainer entity.[HoldStatus <String>]: dataSourceHoldStatus[LastModifiedDateTime <DateTime?>]: Last modified date and time of the dataSourceContainer.[ReleasedDateTime <DateTime?>]: Date and time that the dataSourceContainer was released from the case.[Status <String>]: dataSourceContainerStatus[Id <String>]: The unique identifier for an entity. Read-only.[DataSource <IMicrosoftGraphSecurityDataSource>]: dataSource[(Any) <Object>]: This indicates any property can be added to this object.[Id <String>]: The unique identifier for an entity. Read-only.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[(Any) <Object>]: This indicates any property can be added to this object.[Application <IMicrosoftGraphIdentity>]: identity[(Any) <Object>]: This indicates any property can be added to this object.[DisplayName <String>]: The display name of the identity. The display name might not always be available or up to date. For example, if a user changes their display name, the API might show the new value in a future response, but the items associated with the user won't show up as having changed when using delta.[Id <String>]: Unique identifier for the identity.
[Device <IMicrosoftGraphIdentity>]: identity[User <IMicrosoftGraphIdentity>]: identity
[CreatedDateTime <DateTime?>]: The date and time the dataSource was created.[DisplayName <String>]: The display name of the dataSource and is the name of the SharePoint site.[HoldStatus <String>]: dataSourceHoldStatus
[LastIndexOperation <IMicrosoftGraphSecurityEdiscoveryIndexOperation>]: ediscoveryIndexOperation[(Any) <Object>]: This indicates any property can be added to this object.[Action <String>]: caseAction[CompletedDateTime <DateTime?>]: The date and time the operation was completed.[CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet[CreatedDateTime <DateTime?>]: The date and time the operation was created.[PercentProgress <Int32?>]: The progress of the operation.[ResultInfo <IMicrosoftGraphResultInfo>]: resultInfo[(Any) <Object>]: This indicates any property can be added to this object.[Code <Int32?>]: The result code.[Message <String>]: The message.[Subcode <Int32?>]: The result subcode.
[Status <String>]: caseOperationStatus[Id <String>]: The unique identifier for an entity. Read-only.
RELATED LINKS
https://learn.microsoft.com/graph/api/security-ediscoverysearch-update?view=graph-rest-1.0