Espacio de nombres: microsoft.graph.security
Importante
Las API de la versión /beta de Microsoft Graph están sujetas a cambios. No se admite el uso de estas API en aplicaciones de producción. Para determinar si una API está disponible en la versión 1.0, use el selector de Versión.
Cree un nuevo objeto ediscoverySearch .
Esta API está disponible en las siguientes implementaciones en la nube nacional.
| Servicio global |
Administración pública de EE. UU. |
Gobierno de EE. UU. L5 (DOD) |
China operado por 21Vianet |
| ✅ |
✅ |
✅ |
❌ |
Permissions
Elija el permiso o los permisos marcados como con privilegios mínimos para esta API. Use uno o varios permisos con privilegios más altos solo si la aplicación lo requiere. Para obtener más información sobre los permisos delegados y de aplicación, consulte Tipos de permisos. Para obtener más información sobre estos permisos, consulte la referencia de permisos.
| Tipo de permiso |
Permisos con privilegios mínimos |
Permisos con privilegios más altos |
| Delegado (cuenta profesional o educativa) |
eDiscovery.Read.All |
eDiscovery.ReadWrite.All |
| Delegado (cuenta personal de Microsoft) |
No admitida. |
No admitida. |
| Aplicación |
eDiscovery.Read.All |
eDiscovery.ReadWrite.All |
Importante
Para el acceso delegado con cuentas profesionales o educativas, el usuario que ha iniciado sesión debe tener asignado un rol compatible de Microsoft Purview a través de una de las siguientes opciones:
-
Administrador de la exhibición de documentos electrónicos. Permite a los miembros crear y administrar los casos de eDiscovery que crean, incluida la creación de custodios, retenciones, búsquedas y otras tareas de administración de casos. Sin embargo, los administradores de eDiscovery solo pueden crear y administrar los casos que crean.
Esta es la opción menos privilegiada para administrar sus propios casos.
-
Administrador de eDiscovery. Proporciona todos los permisos de eDiscovery Manager, además de la capacidad de acceder y administrar todos los casos de eDiscovery de la organización, configurar las opciones de eDiscovery y administrar cualquier caso después de agregarse como miembro.
Roles adicionales que proporcionan acceso de escritura a las características de eDiscovery:
-
Administrador de cumplimiento. Incluye administración de casos, búsqueda de cumplimiento y permisos de retención.
-
Administración de la organización. Incluye administración de casos, búsqueda de cumplimiento, retención, y permisos de búsqueda y purga.
Los roles de administrador y administrador de eDiscovery forman parte de los grupos de roles de Microsoft Purview y proporcionan acceso a las características de eDiscovery a través del control de acceso basado en roles (RBAC).
Para obtener más información acerca de los permisos y roles de eDiscovery, consulte Asignar permisos en eDiscovery.
Solicitud HTTP
POST /security/cases/ediscoveryCases/{ediscoveryCaseId}/searches
| Nombre |
Descripción |
| Authorization |
{token} de portador. Obligatorio. Obtenga más información sobre autenticación y autorización. |
| Content-Type |
application/json. Obligatorio. |
Cuerpo de la solicitud
En el cuerpo de la solicitud, proporcione una representación JSON del objeto ediscoverySearch .
Puede especificar las siguientes propiedades al crear un ediscoverySearch.
| Propiedad |
Tipo |
Descripción |
| displayName |
Cadena |
El nombre para mostrar de la búsqueda. Obligatorio |
| description |
Cadena |
La descripción de la búsqueda Opcional. |
| contentQuery |
Cadena |
La cadena de consulta utilizada para la búsqueda. La cadena de consulta en formato KQL (lenguaje de consulta por palabra clave). Opcional |
| dataSourceScopes |
microsoft.graph.security.dataSourceScopes |
La opción de buscar en todos los buzones o sitios del inquilino. Los valores posibles son: none, allTenantMailboxes, allTenantSites, allCaseCustodians, allCaseNoncustodialDataSources. Opcional. |
Respuesta
Si se realiza correctamente, este método devuelve un 201 Created código de respuesta y un objeto microsoft.graph.security.ediscoverySearch en el cuerpo de la respuesta.
Ejemplos
Solicitud
En el ejemplo siguiente se muestra la solicitud.
POST https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches
Content-Type: application/json
{
"displayName": "My search 2",
"description": "My first search",
"contentQuery": "(Author=\"edison\")",
"custodianSources@odata.bind": [
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')"
],
"noncustodialSources@odata.bind": [
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043"
]
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models.Security;
var requestBody = new EdiscoverySearch
{
DisplayName = "My search 2",
Description = "My first search",
ContentQuery = "(Author=\"edison\")",
AdditionalData = new Dictionary<string, object>
{
{
"custodianSources@odata.bind" , new List<string>
{
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')",
}
},
{
"noncustodialSources@odata.bind" , new List<string>
{
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043",
}
},
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Security.Cases.EdiscoveryCases["{ediscoveryCase-id}"].Searches.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
//other-imports
)
requestBody := graphmodelssecurity.NewEdiscoverySearch()
displayName := "My search 2"
requestBody.SetDisplayName(&displayName)
description := "My first search"
requestBody.SetDescription(&description)
contentQuery := "(Author=\"edison\")"
requestBody.SetContentQuery(&contentQuery)
additionalData := map[string]interface{}{
odataBind := []string {
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')",
}
odataBind := []string {
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043",
}
}
requestBody.SetAdditionalData(additionalData)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
searches, err := graphClient.Security().Cases().EdiscoveryCases().ByEdiscoveryCaseId("ediscoveryCase-id").Searches().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.models.security.EdiscoverySearch ediscoverySearch = new com.microsoft.graph.beta.models.security.EdiscoverySearch();
ediscoverySearch.setDisplayName("My search 2");
ediscoverySearch.setDescription("My first search");
ediscoverySearch.setContentQuery("(Author=\"edison\")");
HashMap<String, Object> additionalData = new HashMap<String, Object>();
LinkedList<String> custodianSourcesOdataBind = new LinkedList<String>();
custodianSourcesOdataBind.add("https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639");
custodianSourcesOdataBind.add("https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d");
custodianSourcesOdataBind.add("https://graph.microsoft.com/beta/security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')");
additionalData.put("custodianSources@odata.bind", custodianSourcesOdataBind);
LinkedList<String> noncustodialSourcesOdataBind = new LinkedList<String>();
noncustodialSourcesOdataBind.add("https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043");
additionalData.put("noncustodialSources@odata.bind", noncustodialSourcesOdataBind);
ediscoverySearch.setAdditionalData(additionalData);
com.microsoft.graph.models.security.EdiscoverySearch result = graphClient.security().cases().ediscoveryCases().byEdiscoveryCaseId("{ediscoveryCase-id}").searches().post(ediscoverySearch);
const options = {
authProvider,
};
const client = Client.init(options);
const ediscoverySearch = {
displayName: 'My search 2',
description: 'My first search',
contentQuery: '(Author=\"edison\")',
'custodianSources@odata.bind': [
'https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639',
'https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d',
'https://graph.microsoft.com/beta/security/cases/ediscoveryCases(\'b0073e4e-4184-41c6-9eb7-8c8cc3e2288b\')/custodians(\'0053a61a3b6c42738f7606791716a22a\')/unifiedGroupSources(\'32e14fa4-3106-4bd2-a245-34bf0c718a7e\')'
],
'noncustodialSources@odata.bind': [
'https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043'
]
};
await client.api('/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/searches')
.version('beta')
.post(ediscoverySearch);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\Security\EdiscoverySearch;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new EdiscoverySearch();
$requestBody->setDisplayName('My search 2');
$requestBody->setDescription('My first search');
$requestBody->setContentQuery('(Author=\"edison\")');
$additionalData = [
'custodianSources@odata.bind' => [
'https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639', 'https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d', 'https://graph.microsoft.com/beta/security/cases/ediscoveryCases(\'b0073e4e-4184-41c6-9eb7-8c8cc3e2288b\')/custodians(\'0053a61a3b6c42738f7606791716a22a\')/unifiedGroupSources(\'32e14fa4-3106-4bd2-a245-34bf0c718a7e\')', ],
'noncustodialSources@odata.bind' => [
'https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043', ],
];
$requestBody->setAdditionalData($additionalData);
$result = $graphServiceClient->security()->cases()->ediscoveryCases()->byEdiscoveryCaseId('ediscoveryCase-id')->searches()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Security
$params = @{
displayName = "My search 2"
description = "My first search"
contentQuery = "(Author="edison")"
"custodianSources@odata.bind" = @(
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639"
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d"
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')"
)
"noncustodialSources@odata.bind" = @(
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043"
)
}
New-MgBetaSecurityCaseEdiscoveryCaseSearch -EdiscoveryCaseId $ediscoveryCaseId -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.security.ediscovery_search import EdiscoverySearch
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = EdiscoverySearch(
display_name = "My search 2",
description = "My first search",
content_query = "(Author=\"edison\")",
additional_data = {
"custodian_sources@odata_bind" : [
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/userSources/43434642-3137-3138-3432-374142313639",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/custodians/0053a61a3b6c42738f7606791716a22a/siteSources/169718e3-a8df-449d-bef4-ee09fe1ddc5d",
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/custodians('0053a61a3b6c42738f7606791716a22a')/unifiedGroupSources('32e14fa4-3106-4bd2-a245-34bf0c718a7e')",
],
"noncustodial_sources@odata_bind" : [
"https://graph.microsoft.com/beta/security/cases/ediscoveryCases/b0073e4e-4184-41c6-9eb7-8c8cc3e2288b/noncustodialdatasources/35393639323133394345384344303043",
],
}
)
result = await graph_client.security.cases.ediscovery_cases.by_ediscovery_case_id('ediscoveryCase-id').searches.post(request_body)
Respuesta
En el ejemplo siguiente se muestra la respuesta.
Nota: Se puede acortar el objeto de respuesta que se muestra aquí para mejorar la legibilidad.
HTTP/1.1 201 Created
Content-Type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#security/cases/ediscoveryCases('b0073e4e-4184-41c6-9eb7-8c8cc3e2288b')/searches/$entity",
"dataSourceScopes": "none",
"description": "My first search",
"lastModifiedDateTime": "2022-05-23T04:38:07.5787454Z",
"contentQuery": "(Author=\"edison\")",
"id": "46867792-68e6-41db-9cd0-f651c2290d91",
"displayName": "My search 2",
"createdDateTime": "2022-05-23T04:38:07.5787454Z",
"lastModifiedBy": null,
"createdBy": {
"user": {
"id": "c25c3914-f9f7-43ee-9cba-a25377e0cec6",
"displayName": "MOD Administrator",
"userPrincipalName": "admin@contoso.com"
},
"application": {
"id": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
"displayName": "Graph Explorer"
}
}
}