How griffin31-lab/griffin31-toolkit works
Griffin31 ToolKit is a collection of standalone PowerShell and shell tools for Microsoft 365 security audits, remediation, and threat hunting—not a single service. The main user workflow is to run a tool against a tenant or supply a DNS record, inspect its audit or risk findings, and use its documented report, export, or interactive actions. The README documents product capabilities and outputs; source excerpts were unavailable, so internal call wiring is not inferred.
Main entry points: Threat-Hunting Hunt library · CA-Gap-Analysis.ps1 CA policy analyzer · ca-affected-apps.ps1 Affected-app assessment · entra-appregistration-audit.ps1 App registration audit
Components 24
Conditional Access
- CA policy analyzer
CA-Policy-Analyzer/CA-Gap-Analysis.ps1 - CA HTML report
- Affected-app assessment
CA-Update-AffectedApps/ca-affected-apps.ps1 - Excel risk report
Identity Tools
- App registration audit
Entra-AppRegistration-Audit/entra-appregistration-audit.ps1 - HTML / Excel findings
- Stale device cleanup
Entra-StaleDevices-Cleanup/stale-devices-cleanup.ps1 - Device audit / actions
Collaboration Tools
- SharePoint sites audit
SharePoint-Sites-Audit/SPO-Sites-Audit.ps1 - Collaboration HTML report
- Exchange app permissions
EXO-AppPermissions-Manager/Configure-AppPermissions.ps1 - Planner organizer
Planner-Plan-Organizer/planner-organize.ps1 - Local JSON backup
Threat Hunting
- Hunt library
Threat-Hunting - KQL queries
Threat-Hunting/kql - Detection rules
Threat-Hunting/detection-rules - Indicators of compromise
Threat-Hunting/iocs
Other Utilities
- SPF lookup validator
SPF-Lookup-Validator/spf.sh - Console validation
Other components
- Security engineer
- Entra ID tenant
- Microsoft 365 tenant
- DNS records
- Sentinel / Defender
Connections 28
- Security engineer → CA policy analyzer: runs
- CA policy analyzer → Entra ID tenant: audits policies
- CA policy analyzer → CA HTML report: produces
- Security engineer → Affected-app assessment: runs
- Affected-app assessment → Entra ID tenant: assesses apps
- Affected-app assessment → Excel risk report: produces
- Security engineer → App registration audit: runs
- App registration audit → Entra ID tenant: audits registrations
- App registration audit → HTML / Excel findings: produces
- Security engineer → Stale device cleanup: runs
- Stale device cleanup → Entra ID tenant: audits devices
- Stale device cleanup → Device audit / actions: reports / acts
- Security engineer → SharePoint sites audit: runs
- SharePoint sites audit → Microsoft 365 tenant: audits collaboration
- SharePoint sites audit → Collaboration HTML report: produces
- Security engineer → Exchange app permissions: runs
- Exchange app permissions → Microsoft 365 tenant: configures Exchange
- Security engineer → Planner organizer: runs
- Planner organizer → Microsoft 365 tenant: organizes plan
- Planner organizer → Local JSON backup: exports
- Security engineer → Hunt library: uses
- Hunt library → KQL queries: provides
- Hunt library → Detection rules: provides
- Hunt library → Indicators of compromise: provides
- Security engineer → Sentinel / Defender: hunts in
- Security engineer → SPF lookup validator: runs
- SPF lookup validator → DNS records: checks record
- SPF lookup validator → Console validation: prints