Skip to main content

Google Vault - Search Mail

This Playbook is part of the Google Vault Pack.#

Performs a Google Vault search in Drive accounts and display the results.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • GenericPolling


This playbook does not use any integrations.


  • PrintErrorEntry


  • gvault-download-results
  • gvault-get-drive-results
  • gvault-export-status
  • gvault-create-export-drive

Playbook Inputs#

NameDescriptionDefault ValueRequired
matterIDThe ID of the matter.-Required
exportNameThe name of the exported file.-Required
dataScopeThe choice of Search scope.All DataOptional
searchMethodThe choice of Search method. The default is: "Specific Accounts", this requires the emails argument. "Organizational Unit", this requires ou argument. "Team Drive".Specific AccountsOptional
emailsWhether the search method is set to "Specific Accounts" (separated by comma).-Optional
ouWhether the search method is set to "Specific Accounts" (separated by comma).-Optional
teamDriveWhether the search method is set to "Team Drives".-Optional
includeTeamDrivesInclude/Exclude team drives.trueOptional
timeFrameThe search time frame. For example, "1 min ago","2 weeks ago","3 months ago".-Optional
startTimeThe UTC start time. For example, 2018-10-16T12:59:02.584000Z.-Optional
endTimeThe UTC end time. For example, 2018-10-16T12:59:02.584000Z.-Optional
termsAdd specific terms for the search (subject:example).-Optional
exportPSTThe export format.trueOptional
exportMBOXThe export format.falseOptional
pollIntervalThe interval to check export status (in minutes). For big data inquires increase both pollInterval and pollTimeout2Optional
pollTimeoutThe timeout to terminate the poll (in minutes). For big data inquires increase both pollTimeout and pollInterval.30Optional
maxResultForDisplayThe maximal number of result to be displayed.30Optional
downloadFileWhether the export file will be downloaded into the War Room. If set to "Ture" this will occur.falseOptional

Playbook Outputs#

GoogleVault.Matter.Export.MatterIDThe matter ID.string
GoogleVault.Matter.Export.ExportIDThe export ID.string
GoogleVault.Matter.Export.NameThe export's name.string
GoogleVault.Matter.Export.CreateTimeThe export's creation time.string
GoogleVault.Matter.Export.Results.TitleThe title of the file.string
GoogleVault.Matter.Export.Results.AuthorThe author of the file.string
GoogleVault.Matter.Export.Results.OthersThe other users related to the file.string
GoogleVault.Matter.Export.Results.ViewersThe viewers of the file.string
GoogleVault.Matter.Export.Results.DateModifiedThe date the file was modified.string
GoogleVault.Matter.Export.Results.DateCreatedThe date the file was created.string
GoogleVault.Matter.Export.Results.DocTypeThe type of the file (extension).string
GoogleVault.Matter.Export.Results.MD5The MD5 hash of the file (SHA1).string
GoogleVault.Matter.Export.StatusThe export status. Can be, "COMPLETED", "FAILED", or "IN_PROGRESS".string
GoogleVault.Matter.Export.BucketNameThe bucket holder name for this export.string
GoogleVault.Matter.Export.DownloadIDThe ID to be used by the download-export command.string
GoogleVault.Matter.Export.ViewIDThe ID to be used by the get-X-results command (X=drive/mail/groups).string
GoogleVault.MatterThe matter object.unknown

Playbook Image#