New-MgSecurityTriggerRetentionEvent

New-MgSecurityTriggerRetentionEvent
    [-ResponseHeadersVariable <string>]
    [-AdditionalProperties <hashtable>]
    [-CreatedBy <IMicrosoftGraphIdentitySet>]
    [-CreatedDateTime <datetime>]
    [-Description <string>]
    [-DisplayName <string>]
    [-EventPropagationResults <IMicrosoftGraphSecurityEventPropagationResult[]>]
    [-EventQueries <IMicrosoftGraphSecurityEventQuery[]>]
    [-EventStatus <IMicrosoftGraphSecurityRetentionEventStatus>]
    [-EventTriggerDateTime <datetime>]
    [-Id <string>]
    [-LastModifiedBy <IMicrosoftGraphIdentitySet>]
    [-LastModifiedDateTime <datetime>]
    [-LastStatusUpdateDateTime <datetime>]
    [-RetentionEventType <IMicrosoftGraphSecurityRetentionEventType>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

New-MgSecurityTriggerRetentionEvent
    -BodyParameter <IMicrosoftGraphSecurityRetentionEvent>
    [-ResponseHeadersVariable <string>]
    [-Break]
    [-Headers <IDictionary>]
    [-HttpPipelineAppend <SendAsyncStep[]>]
    [-HttpPipelinePrepend <SendAsyncStep[]>]
    [-Proxy <uri>]
    [-ProxyCredential <pscredential>]
    [-ProxyUseDefaultCredentials]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Create a new retentionEvent object.

Permissions

Import-Module Microsoft.Graph.Security

$params = @{
	"@odata.type" = "#microsoft.graph.security.retentionEvent"
	displayName = "String"
	description = "String"
	eventQuery = @(
		@{
			"@odata.type" = "microsoft.graph.security.eventQuery"
		}
	)
	eventTriggerDateTime = [System.DateTime]::Parse("String (timestamp)")
	"retentionEventType@odata.bind" = "https://graph.microsoft.com/v1.0/security/triggerTypes/retentionEventType/9eecef97-fb3c-4c68-825b-4dd74530863a"
}

New-MgSecurityTriggerRetentionEvent -BodyParameter $params

This example shows how to use the New-MgSecurityTriggerRetentionEvent Cmdlet.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

{{ Fill in the Description }}

{{ Fill in the Description }}

{{ Fill in the Description }}

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

BODYPARAMETER <IMicrosoftGraphSecurityRetentionEvent>: retentionEvent [(Any) <Object>]: This indicates any property can be added to this object. [Id <String>]: The unique identifier for an entity. Read-only. [CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet [(Any) <Object>]: This indicates any property can be added to this object. [Application <IMicrosoftGraphIdentity>]: identity [(Any) <Object>]: This indicates any property can be added to this object. [DisplayName <String>]: The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta. [Id <String>]: Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review. [Device <IMicrosoftGraphIdentity>]: identity [User <IMicrosoftGraphIdentity>]: identity [CreatedDateTime <DateTime?>]: The date time when the retentionEvent was created. [Description <String>]: Optional information about the event. [DisplayName <String>]: Name of the event. [EventPropagationResults <IMicrosoftGraphSecurityEventPropagationResult[]>]: Represents the success status of a created event and additional information. [Location <String>]: The name of the specific location in the workload associated with the event. [ServiceName <String>]: The name of the workload associated with the event. [Status <String>]: eventPropagationStatus [StatusInformation <String>]: Additional information about the status of the event creation request. [EventQueries <IMicrosoftGraphSecurityEventQuery[]>]: Represents the workload (SharePoint Online, OneDrive for Business, Exchange Online) and identification information associated with a retention event. [Query <String>]: Represents unique identification for the query. 'Asset ID' for SharePoint Online and OneDrive for Business, 'keywords' for Exchange Online. [QueryType <String>]: queryType [EventStatus <IMicrosoftGraphSecurityRetentionEventStatus>]: retentionEventStatus [(Any) <Object>]: This indicates any property can be added to this object. [Error <IMicrosoftGraphPublicError>]: publicError [(Any) <Object>]: This indicates any property can be added to this object. [Code <String>]: Represents the error code. [Details <IMicrosoftGraphPublicErrorDetail[]>]: Details of the error. [Code <String>]: The error code. [Message <String>]: The error message. [Target <String>]: The target of the error. [InnerError <IMicrosoftGraphPublicInnerError>]: publicInnerError [(Any) <Object>]: This indicates any property can be added to this object. [Code <String>]: The error code. [Details <IMicrosoftGraphPublicErrorDetail[]>]: A collection of error details. [Message <String>]: The error message. [Target <String>]: The target of the error. [Message <String>]: A non-localized message for the developer. [Target <String>]: The target of the error. [Status <String>]: eventStatusType [EventTriggerDateTime <DateTime?>]: Optional time when the event should be triggered. [LastModifiedBy <IMicrosoftGraphIdentitySet>]: identitySet [LastModifiedDateTime <DateTime?>]: The latest date time when the retentionEvent was modified. [LastStatusUpdateDateTime <DateTime?>]: Last time the status of the event was updated. [RetentionEventType <IMicrosoftGraphSecurityRetentionEventType>]: retentionEventType [(Any) <Object>]: This indicates any property can be added to this object. [Id <String>]: The unique identifier for an entity. Read-only. [CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet [CreatedDateTime <DateTime?>]: The date time when the retentionEventType was created. [Description <String>]: Optional information about the event type. [DisplayName <String>]: Name of the event type. [LastModifiedBy <IMicrosoftGraphIdentitySet>]: identitySet [LastModifiedDateTime <DateTime?>]: The latest date time when the retentionEventType was modified.

CREATEDBY <IMicrosoftGraphIdentitySet>: identitySet [(Any) <Object>]: This indicates any property can be added to this object. [Application <IMicrosoftGraphIdentity>]: identity [(Any) <Object>]: This indicates any property can be added to this object. [DisplayName <String>]: The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta. [Id <String>]: Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review. [Device <IMicrosoftGraphIdentity>]: identity [User <IMicrosoftGraphIdentity>]: identity

EVENTPROPAGATIONRESULTS <IMicrosoftGraphSecurityEventPropagationResult[]>: Represents the success status of a created event and additional information. [Location <String>]: The name of the specific location in the workload associated with the event. [ServiceName <String>]: The name of the workload associated with the event. [Status <String>]: eventPropagationStatus [StatusInformation <String>]: Additional information about the status of the event creation request.

EVENTQUERIES <IMicrosoftGraphSecurityEventQuery[]>: Represents the workload (SharePoint Online, OneDrive for Business, Exchange Online) and identification information associated with a retention event. [Query <String>]: Represents unique identification for the query. 'Asset ID' for SharePoint Online and OneDrive for Business, 'keywords' for Exchange Online. [QueryType <String>]: queryType

EVENTSTATUS <IMicrosoftGraphSecurityRetentionEventStatus>: retentionEventStatus [(Any) <Object>]: This indicates any property can be added to this object. [Error <IMicrosoftGraphPublicError>]: publicError [(Any) <Object>]: This indicates any property can be added to this object. [Code <String>]: Represents the error code. [Details <IMicrosoftGraphPublicErrorDetail[]>]: Details of the error. [Code <String>]: The error code. [Message <String>]: The error message. [Target <String>]: The target of the error. [InnerError <IMicrosoftGraphPublicInnerError>]: publicInnerError [(Any) <Object>]: This indicates any property can be added to this object. [Code <String>]: The error code. [Details <IMicrosoftGraphPublicErrorDetail[]>]: A collection of error details. [Message <String>]: The error message. [Target <String>]: The target of the error. [Message <String>]: A non-localized message for the developer. [Target <String>]: The target of the error. [Status <String>]: eventStatusType

LASTMODIFIEDBY <IMicrosoftGraphIdentitySet>: identitySet [(Any) <Object>]: This indicates any property can be added to this object. [Application <IMicrosoftGraphIdentity>]: identity [(Any) <Object>]: This indicates any property can be added to this object. [DisplayName <String>]: The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta. [Id <String>]: Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review. [Device <IMicrosoftGraphIdentity>]: identity [User <IMicrosoftGraphIdentity>]: identity

RETENTIONEVENTTYPE <IMicrosoftGraphSecurityRetentionEventType>: retentionEventType [(Any) <Object>]: This indicates any property can be added to this object. [Id <String>]: The unique identifier for an entity. Read-only. [CreatedBy <IMicrosoftGraphIdentitySet>]: identitySet [(Any) <Object>]: This indicates any property can be added to this object. [Application <IMicrosoftGraphIdentity>]: identity [(Any) <Object>]: This indicates any property can be added to this object. [DisplayName <String>]: The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta. [Id <String>]: Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review. [Device <IMicrosoftGraphIdentity>]: identity [User <IMicrosoftGraphIdentity>]: identity [CreatedDateTime <DateTime?>]: The date time when the retentionEventType was created. [Description <String>]: Optional information about the event type. [DisplayName <String>]: Name of the event type. [LastModifiedBy <IMicrosoftGraphIdentitySet>]: identitySet [LastModifiedDateTime <DateTime?>]: The latest date time when the retentionEventType was modified.