manage_evidence_collection
Collect and preserve compliance evidence like audit logs, configuration snapshots, and attestation records for Microsoft 365 services to meet regulatory requirements.
Instructions
Collect and preserve compliance evidence including audit logs, configuration snapshots, and attestation records.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Evidence collection action | |
| evidenceType | No | Type of evidence to collect | |
| timeRange | No | Time range for evidence collection | |
| systems | No | Specific systems to collect evidence from |
Implementation Reference
- The core handler function implementing the manage_evidence_collection tool logic. Handles actions: collect (starts evidence collection), schedule, get_status, download. Uses helper functions for detailed operations.export async function handleEvidenceCollection( graphClient: Client, args: EvidenceCollectionArgs ): Promise<{ content: { type: string; text: string }[] }> { let result: any; switch (args.action) { case 'collect': // Start evidence collection const collectionId = `collection-${Date.now()}`; result = await startEvidenceCollection(graphClient, collectionId, args); break; case 'schedule': result = { collectionId: args.collectionId, scheduledTime: args.settings?.scheduledTime, status: 'scheduled', message: 'Evidence collection scheduled successfully' }; break; case 'get_status': if (!args.collectionId) { throw new McpError(ErrorCode.InvalidParams, 'collectionId is required for get_status action'); } result = await getCollectionStatus(args.collectionId); break; case 'download': if (!args.collectionId) { throw new McpError(ErrorCode.InvalidParams, 'collectionId is required for download action'); } result = await downloadEvidence(args.collectionId); break; default: throw new McpError(ErrorCode.InvalidParams, `Invalid action: ${args.action}`); } return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }; }
- src/server.ts:963-983 (registration)MCP server registration of the 'manage_evidence_collection' tool, binding the handleEvidenceCollection handler, input schema, and annotations.// Evidence Collection - Lazy loading enabled for tool discovery this.server.tool( "manage_evidence_collection", "Collect and preserve compliance evidence including audit logs, configuration snapshots, and attestation records.", evidenceCollectionSchema.shape, {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}, wrapToolHandler(async (args: EvidenceCollectionArgs) => { this.validateCredentials(); try { return await handleEvidenceCollection(this.getGraphClient(), args); } catch (error) { if (error instanceof McpError) { throw error; } throw new McpError( ErrorCode.InternalError, `Error executing tool: ${error instanceof Error ? error.message : 'Unknown error'}` ); } }) );
- TypeScript interface defining the input arguments structure for the manage_evidence_collection tool, including action types and settings.export interface EvidenceCollectionArgs { action: 'collect' | 'schedule' | 'get_status' | 'download'; collectionId?: string; framework?: 'hitrust' | 'iso27001' | 'soc2'; controlIds?: string[]; evidenceTypes?: ('configuration' | 'logs' | 'policies' | 'screenshots' | 'documents')[]; settings?: { automated: boolean; scheduledTime?: string; retention: number; // days encryption: boolean; compression: boolean; }; }
- src/tool-definitions.ts:422-430 (schema)Zod validation schema for the manage_evidence_collection tool inputs, used during MCP server registration.export const evidenceCollectionSchema = z.object({ action: z.enum(['get_status', 'schedule', 'collect', 'download']).describe('Evidence collection action'), evidenceType: z.enum(['configuration', 'logs', 'policies', 'certificates', 'reports']).optional().describe('Type of evidence to collect'), timeRange: z.object({ start: z.string().describe('Start date (ISO format)'), end: z.string().describe('End date (ISO format)'), }).optional().describe('Time range for evidence collection'), systems: z.array(z.string()).optional().describe('Specific systems to collect evidence from'), });
- src/tool-metadata.ts:186-189 (schema)Tool metadata providing description, title, and behavioral annotations (readOnlyHint, destructiveHint, etc.) for the manage_evidence_collection tool.manage_evidence_collection: { description: "Collect and preserve compliance evidence including audit logs, configuration snapshots, and attestation records.", title: "Evidence Collection Tool", annotations: { title: "Evidence Collection Tool", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }