Skip to main content

Google Vault - Search Drive

This Playbook is part of the Google Vault Pack.#

Performs a Google Vault search in Drive accounts and displays the results.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

  • GenericPolling

Integrations#

This playbook does not use any integrations.

Scripts#

  • PrintErrorEntry

Commands#

  • gvault-download-results
  • gvault-get-drive-results
  • gvault-export-status
  • gvault-create-export-drive

Playbook Inputs#


NameDescriptionDefault ValueRequired
matterIDThe ID of the matter.-Required
exportNameThe name of the exported file.-Required
dataScopeThe choice of the search scope.All DataOptional
searchMethodThe choice of search method. The default is: "Specific Accounts" - which requires emails argument. 'Organizational Unit' - requires ou argument. 'Team Drive'The specific accounts.Optional
emailsWhether the search method is set to specific accounts (separated by comma).-Optional
ouWhether the search method is set to specific accounts (separated by comma).-Optional
teamDriveWhether the search method is set to team drives.-Optional
includeTeamDrivesInclude/Exclude team drives.trueOptional
timeFrameThe search time frame. For example, "1 min ago","2 weeks ago","3 months ago".-Optional
startTimeThe UTC start time. For example, 2018-10-16T12:59:02.584000Z.-Optional
endTimeThe UTC end time. For example, 2018-10-16T12:59:02.584000Z.-Optional
termsAdds specific terms for the search. For example, subject:example.-Optional
exportPSTThe export format.trueOptional
exportMBOXThe export format.falseOptional
pollIntervalThe interval to check export status (in minutes). For big data inquires increase both pollInterval and pollTimeout.2Optional
pollTimeoutThe timeout to terminate the poll (in minutes). For big data inquires increase both pollTimeout and pollInterval.30Optional
maxResultForDisplayThe maximal number of result to be displayed.30Optional
downloadFileWhether the exproted file will be downloaded into the War Room. If set to "Ture" this will happen.falseOptional

Playbook Outputs#


PathDescriptionType
GoogleVault.Matter.Export.MatterIDThe matter ID.string
GoogleVault.Matter.Export.ExportIDThe export ID.string
GoogleVault.Matter.Export.NameThe export's name.string
GoogleVault.Matter.Export.CreateTimeThe export's creation time.string
GoogleVault.Matter.Export.Results.TitleThe title of the file.string
GoogleVault.Matter.Export.Results.AuthorThe author of the file.string
GoogleVault.Matter.Export.Results.OthersThe other users related to the file.string
GoogleVault.Matter.Export.Results.ViewersThe viewers of the file.string
GoogleVault.Matter.Export.Results.DateModifiedThe date the file was modified.string
GoogleVault.Matter.Export.Results.DateCreatedThe date the file was created.string
GoogleVault.Matter.Export.Results.DocTypeThe type of the file (extension).string
GoogleVault.Matter.Export.Results.MD5The MD5 hash of the file (SHA1).string
GoogleVault.Matter.Export.StatusThe export status. Can be, "COMPLETED", "FAILED", or "IN_PROGRESS".string
GoogleVault.Matter.Export.BucketNameThe bucket holder name for this export.string
GoogleVault.Matter.Export.DownloadIDThe ID to be used by the download-export command.string
GoogleVault.Matter.Export.ViewIDThe ID to be used by the get-X-results command (X=drive/mail/groups).string
GoogleVault.MatterThe matter object.unknown

Playbook Image#


GVault_Search_Drive