Search monitoring
search_monitoringFind a keyword across sites, apps, mail, files, and other monitored activity in one parallel search, reducing the need for multiple lookups.
Instructions
Console Tools → Search: parallel Monitoring fan-out with FilterKey.
Use for: 'find keyword X across activity' (sites/apps/keys/mail/files/…). Prefer this over calling list_monitoring many times. Not for Risks (list_risks), idle (get_idle_summary), or formal Alerts (list_anomalies). Does not search SearchQueries.
kinds: optional comma-separated subset (e.g. "Sites,Apps,Mail" or "sites,mail"). Default = all Tools Search sources.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kinds | No | Optional comma-separated kinds, e.g. Sites,Apps,Mail. | |
| offset | No | Pagination offset (0-based). | |
| period | No | Relative period: today|yesterday|last_7_days|last_30_days (wins over date_from/date_to when set). | |
| date_to | No | End datetime; date-only covers until 23:59:59 that day. | |
| user_id | No | User filter: AliasID as TreeviewUsers NodeType=1. | |
| group_id | No | Group filter: TreeviewUsers NodeType=14 (console group id). | |
| max_rows | No | ||
| date_from | No | Start datetime YYYY-MM-DD or YYYY-MM-DD HH:MM:SS (full day if date-only). | |
| filter_key | Yes | Keyword for Tools → Search fan-out across Monitoring. | |
| per_source_limit | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||