Use the Natural Language Query builder to create search queries (preview)

  • Article

The Natural Language Query (preview) builder option in collection search tool allows you to use natural language and Microsoft Security Copilot to quickly generate a Keyword Query Language (KeyQL) statement when you build search queries in Microsoft Purview eDiscovery (Premium).

Use the Natural Language Query (preview) builder to construct complex queries with additional functionality, including AND, OR, and grouping of conditions, all while using natural language prompts. This feature helps you build queries more easily using predefined prompts for example scenarios and allows you to refine and enhance custom prompts for more accurate search queries.

Tip

If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview compliance portal trials hub. Learn details about signing up and trial terms.

Prerequisites to use the Natural Language Query (preview) builder

You must have Microsoft Security Copilot to use the Natural Language Query (preview) builder. For Security Copilot guidance, see the following:

Microsoft Purview eDiscovery capabilities are included with Microsoft Purview. For more information, see Subscriptions and licensing.

For information about permissions you need to use the Natural Language Query (preview) builder, see Understand authentication in Microsoft Security Copilot.

Displaying the Natural Language Query (preview) builder

When you create or edit an eDiscovery search for a collection in eDiscovery (Premium), the option to display and use the Natural Language Query builder is located on the Search query page in the collections wizard. Select Natural Language Query to display and use the query builder.

Using the Natural Language Query (preview) builder

After you've selected data sources for a search query, you can create a customized KeyQL search query from a natural language prompt using Security Copilot. You can also choose to use prompt suggestions as a starting point to create and refine KeyQL queries for common or custom search scenarios.

After you've selected data sources for a search query, you can create a customized KeyQL search query from a natural language prompt using Microsoft Security Copilot. You can also choose to use prompt suggestions as a starting point to create and refine KeyQL queries for common or custom search scenarios.

  1. In the Natural language prompt pane, choose one of the following options:
    • Enter your search query question. You can include user, data source, and other content details as applicable.
    • Select View prompts to select one of the following prompt suggestions:
      • Find all emails containing the words budget and finance and have attachments
      • Search all chats in the month of January 2020 that contain the word 'financial year'
      • Search for files of type .docx that contain the words confidential and budget
  2. Review the natural language prompt. To refine the prompt with Copilot, select Refine.
  3. When the prompt is finalized, select Generate KeyQL.
  4. Review the KeyQL query in the Keyword Query Language (KeyQL) result pane. If you need to refine the KeyQL query results, you can update the prompt in the Natural language prompt pane and select Generate KeyQL again. 1. When the KeyQL results are finalized, select Copy KeyQL.
  5. Paste the KeyQL results in the query field on the Keyword query language (KeyQL) tab. You can close Draft a query with Copilot.
  6. Select Next.
  7. On the Review your collection page, you can review and update the collection selection, data sources, and conditions that you configured on the previous pages. Select Edit for any of the selections and update if needed.
  8. Select Submit to create the collection estimate. A page is displayed confirming that the collection was created.