How best-geek/identifirelease works
Identifi detects anomalous Microsoft 365 login behavior: audit activity is read from Elasticsearch, converted into login history and behavioral features, learned per-user models score recent activity, and explainable detections are made available for investigation through the web UI and API. Analysts can inspect users and detections, tune and simulate suppression rules, and configure integrations; administrators also manage users, access, and system settings. The README documents webhook alerting, audit logging, and investigative assistance. Some backend modules are represented from the tree and README only; their internal wiring is not asserted here.
Main entry points: api_server.py API server · detection_pipeline.py Detection pipeline · router.js UI routes · document_to_redis.py Ingestion runner
Components 24
Ingestion and features
- Ingestion runner
python/document_to_redis.py - Log source adapter
python/data_source.py - Login features
python/user_agent_classifier.py
Modeling and detection
- Model training
python/login_model_run.py - User models
python/login_model.py - Detection pipeline
python/detection_pipeline.py - Rule evaluation
python/semantic_rule_engine.py
API and administration
- API server
python/api_server.py - Authentication and roles
python/authentication.py - API rate limiting
python/api_rate_limiter.py - System settings
indentifi_ui/src/components/SettingsView.vue
Investigation and tuning
- Identifi web UI
indentifi_ui/src/App.vue - UI routes
indentifi_ui/src/router.js - Detection investigation
indentifi_ui/src/components/DetectionDetail.vue - User investigation
indentifi_ui/src/components/UserDetails.vue - Suppression tuning
indentifi_ui/src/components/SuppresionRule.vue - Investigative assistance
python/ai_inference/identifi_chat_skills.py
Storage and integrations
- Elasticsearch
- Redis history
- MongoDB
- User webhooks
- Audit log
python/db_logger.py
Other components
- Microsoft 365
- Analyst or admin
Connections 29
- Microsoft 365 → Elasticsearch: sends audit logs
- Elasticsearch → Log source adapter: queries log data
- Ingestion runner → Log source adapter: reads source
- Ingestion runner → Login features: derives features
- Ingestion runner → Redis history: stores login history
- Redis history → Model training: provides history
- Model training → User models: trains models
- Redis history → Detection pipeline: provides recent logins
- Detection pipeline → User models: scores activity
- Detection pipeline → Rule evaluation: evaluates suppression
- Detection pipeline → MongoDB: stores detections
- Detection pipeline → User webhooks: sends alerts
- Analyst or admin → Identifi web UI: uses
- Identifi web UI → UI routes: navigates
- Identifi web UI → API server: requests data
- API server → Authentication and roles: checks credentials
- API server → API rate limiting: limits requests
- API server → MongoDB: reads and writes
- API server → Redis history: reads and writes
- UI routes → Detection investigation: routes detections
- UI routes → User investigation: routes users
- UI routes → Suppression tuning: routes rule editing
- UI routes → System settings: routes settings
- Detection investigation → API server: requests details
- User investigation → API server: requests activity
- Suppression tuning → API server: saves rules
- System settings → API server: configures system
- Detection pipeline → Audit log: records events
- Investigative assistance → API server: assists investigations