avanan_search_emails
Search secured emails and SaaS objects by platform and date range, applying optional filters like sender, subject, or quarantine status to locate specific security events.
Instructions
Search secured entities (emails and SaaS objects) by platform and date range, with optional attribute filters (fromEmail, subject, recipients, isQuarantined, attachmentMd5, ...).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| saas | Yes | SaaS platform, e.g. office365_emails, google_mail, office365_onedrive, slack, ms_teams. | |
| scopes | No | MSP keys only: restrict to these farm:tenant scopes (see avanan_list_scopes). | |
| endDate | No | End of the time frame (ISO 8601). Defaults to now. | |
| filters | No | Attribute filters, ANDed together. | |
| scrollId | No | Pagination scroll ID from a previous response. | |
| startDate | Yes | Start of the time frame (ISO 8601). | |
| saasEntity | No | SaaS entity type, e.g. office365_emails_email. |