Skip to content

Searchable content

The table below provides a list of searchable fields and properties for each workload supported by Afi.

WorkloadSearchable data
Gmail and Exchange mail Email subject
Email body
From
To/CC/BCC
Received time
Attachment names
Google Drive and OneDrive File name
File modification time
File extension
File mime-type (for Google Drive)
File ID (for Google Drive)
SharePoint Subsite name
Library/list name
File name
File extension
File modification time
Google and Exchange calendar events Event subject and body
Event attendees
Attachment names
Google and Exchange contacts Contact name
Contact emails
Contact phones
Contact fields and notes
Exchange tasks Task title and notes
Task modification time
Attachment names
Team Chats Message body
From
To
Received time
Attachment names
Team Channels Message body
From
To
Received time
Attachment names
Microsoft Planner Plan name

Task title and description
Task creation time
Task creator
Task assignees
Task checklist items
Attachment names
Microsoft Copilot Message body
Message creation time
Google Chats Message body
From
To
Received time
Attachment names
Entra ID (Azure Active Directory) User name and email
User phone
User company
User department
User job title
User location

Group name and email
Group description

Role name and description

Conditional access policy name and description
Authentication context name and description
Authentication strength name and description
Named location name and description

Device name and description
Compliance policy name and description
Configuration policy name and description

Audit event type
Audit event time
Audit event initiator
Audit event category
Audit event operation
Audit event target and target type

Administrative unit name
Administrative unit description
Google Directory User name and email
User phone
User company
User department
User job title
User location

Group name and email
Group description

Organizational unit name
Organizational unit description
Google Classroom Course name
Course description
Course creation time
Course state
Course room
Student and teacher emails for the course

Announcement body
Announcement creation time
Announcement state
Announcement attachments

Coursework title
Coursework description and content
Coursework creation time
Coursework state
Coursework topic
Coursework attachments

Coursework material title
Coursework material content
Coursework material creation time
Coursework material state
Coursework material topic
Coursework material attachments

Submission creation time
Submission (assignment) state
Submission coursework
Submission content
Submission attachments
Submission author (student)
Power Platform Power BI report name
Power BI report modification time

Power BI dashboard name

Power BI dataflow name

Power Apps application name
Power Apps application modification time
Power Apps application owner name
Power Apps application owner email

Power Automate flow name
Power Automate flow modification time
Power Automate flow owner name
Power Automate flow owner email

Power Platform DLP policy name
Power Platform DLP policy modification time
Azure virtual machines Virtual machine
Name
Identifier
Subscription identifier
Resource group name
Location
Tags

Disk
Name
Identifier
Subscription identifier
Resource group name
Location
Tags

Network interface
Name
Identifier
Subscription identifier
Resource group name
Location
Subnet identifier
Security group identifier
MAC address
Tags

Public IP address
Name
Identifier
Subscription identifier
Resource group name
Location
DNS name
IP address
Tags
Azure databases Database
Name
Identifier
Subscription identifier
Resource group name
Location
Tags

SQL tables and scripts
Name
AWS EC2 instances Virtual machine
Name
Identifier
Region and zone
Tags

Disk
Name
Identifier
Region and zone
Tags

Network interface
Name
Identifier
Region and zone
Tags