ediscoverySearch resource type

Namespace: microsoft.graph.security

Represents an eDiscovery search. For details, see Collect data for a case in eDiscovery (Premium).

Methods

Method	Return type	Description
List	microsoft.graph.security.ediscoverySearch collection	Get a list of the ediscoverySearch objects and their properties.
Create	microsoft.graph.security.ediscoverySearch	Create a new ediscoverySearch object.
Get	microsoft.graph.security.ediscoverySearch	Read the properties and relationships of an ediscoverySearch object.
Update	microsoft.graph.security.ediscoverySearch	Update the properties of an ediscoverySearch object.
Delete	None	Delete an microsoft.graph.security.ediscoverySearch object.
Estimate statistics	None	Run an estimate statistics operation on the data contained in the eDiscovery search.
Purge data	None	Delete Exchange mailbox items or Microsoft Teams messages contained in an eDiscovery search.
Export report	None	Export an item report from an estimated ediscoverySearch.
Export result	None	Export results from an estimated ediscoverySearch.
List additional sources	microsoft.graph.security.dataSource collection	Get the list of additional sources associated with an eDiscovery search.
Add additional sources	microsoft.graph.security.dataSource	Create a new additional source associated with an eDiscovery search.
Get last estimate statistics operation	microsoft.graph.security.ediscoveryEstimateOperation collection	Get the last ediscoveryEstimateOperation objects and their properties.
List custodian sources	microsoft.graph.security.dataSource collection	Get the list of custodial data sources associated with an eDiscovery search.
Add custodian sources	microsoft.graph.security.dataSource	Create a new custodian source associated with an eDiscovery search.
Remove custodian sources	None	Remove a microsoft.graph.security.dataSource object.
List non-custodial data sources	microsoft.graph.security.ediscoveryNoncustodialDataSource collection	Get the list of non-custodialSources associated with an eDiscovery search.
Add non-custodial data sources	microsoft.graph.security.ediscoveryNoncustodialDataSource	Create a new non-custodial source associated with an eDiscovery search.
Remove non-custodial data sources	None	Remove an microsoft.graph.security.ediscoveryNoncustodialDataSource object.

Properties

Property	Type	Description
contentQuery	String	The query string in KQL (Keyword Query Language) query. For details, see Keyword queries and search conditions for Content Search and eDiscovery. You can refine searches by using fields paired with values; for example, subject:"Quarterly Financials" AND Date>=06/01/2016 AND Date<=07/01/2016.
createdBy	identitySet	The user who created the eDiscovery search.
createdDateTime	DateTimeOffset	The date and time the eDiscovery search was created.
dataSourceScopes	microsoft.graph.security.dataSourceScopes	When specified, the collection spans across a service for an entire workload. Possible values are: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources.
description	String	The description of the eDiscovery search.
displayName	String	The display name of the eDiscovery search.
id	String	The ID for the eDiscovery search. Read-only.
lastModifiedBy	identitySet	The last user who modified the eDiscovery search.
lastModifiedDateTime	DateTimeOffset	The last date and time the eDiscovery search was modified.

dataSourceScopes values

Member	Description
none	Don't specify any scopes - locations would be referenced separately.
allTenantMailboxes	Include all tenant mailboxes in the eDiscovery search.
allTenantSites	Include all tenant sites in the eDiscovery search.
allCaseCustodians	Include all custodian locations in the eDiscovery search.
allCaseNoncustodialDataSources	Include all non-custodial data sources in the eDiscovery search.

Relationships

Relationship	Type	Description
additionalSources	microsoft.graph.security.dataSource collection	Adds an additional source to the eDiscovery search.
addToReviewSetOperation	microsoft.graph.security.ediscoveryAddToReviewSetOperation	Adds the results of the eDiscovery search to the specified reviewSet.
custodianSources	microsoft.graph.security.dataSource collection	Custodian sources that are included in the eDiscovery search.
lastEstimateStatisticsOperation	microsoft.graph.security.ediscoveryEstimateOperation	The last estimate operation associated with the eDiscovery search.
noncustodialSources	microsoft.graph.security.ediscoveryNoncustodialDataSource collection	noncustodialDataSource sources that are included in the eDiscovery search

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.ediscoverySearch",
  "id": "String (identifier)",
  "displayName": "String",
  "description": "String",
  "createdBy": {
    "@odata.type": "microsoft.graph.identitySet"
  },
  "createdDateTime": "String (timestamp)",
  "lastModifiedBy": {
    "@odata.type": "microsoft.graph.identitySet"
  },
  "lastModifiedDateTime": "String (timestamp)",
  "contentQuery": "String",
  "dataSourceScopes": "String"
}