# griffin31-lab/griffin31-toolkit architecture

> Architecture diagram of the GitHub repository griffin31-lab/griffin31-toolkit, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/griffin31-lab/griffin31-toolkit
- Repository: https://github.com/griffin31-lab/griffin31-toolkit

## Overview

Griffin31 ToolKit is a collection of standalone PowerShell and shell tools for Microsoft 365 security audits, remediation, and threat hunting—not a single service. The main user workflow is to run a tool against a tenant or supply a DNS record, inspect its audit or risk findings, and use its documented report, export, or interactive actions. The README documents product capabilities and outputs; source excerpts were unavailable, so internal call wiring is not inferred.

Main entry points: [`Threat-Hunting`](https://github.com/griffin31-lab/griffin31-toolkit/tree/main/Threat-Hunting) (Hunt library), [`CA-Policy-Analyzer/CA-Gap-Analysis.ps1`](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/CA-Policy-Analyzer/CA-Gap-Analysis.ps1) (CA policy analyzer), [`CA-Update-AffectedApps/ca-affected-apps.ps1`](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/CA-Update-AffectedApps/ca-affected-apps.ps1) (Affected-app assessment), [`Entra-AppRegistration-Audit/entra-appregistration-audit.ps1`](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/Entra-AppRegistration-Audit/entra-appregistration-audit.ps1) (App registration audit)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ca["Conditional Access"]
  node_ca_audit["CA policy analyzer"]
  node_ca_report["CA HTML report"]
  node_ca_apps["Affected-app assessment"]
  node_ca_risk["Excel risk report"]
end

subgraph group_identity["Identity Tools"]
  node_app_audit["App registration audit"]
  node_app_outputs["HTML / Excel findings"]
  node_device_cleanup["Stale device cleanup"]
  node_device_output["Device audit / actions"]
end

subgraph group_collab["Collaboration Tools"]
  node_spo_audit["SharePoint sites audit"]
  node_spo_report["Collaboration HTML report"]
  node_exo_manager["Exchange app permissions"]
  node_planner["Planner organizer"]
  node_planner_backup["Local JSON backup"]
end

subgraph group_threat["Threat Hunting"]
  node_hunt["Hunt library"]
  node_hunt_queries["KQL queries"]
  node_hunt_rules["Detection rules"]
  node_hunt_iocs["Indicators of compromise"]
end

subgraph group_other["Other Utilities"]
  node_spf["SPF lookup validator<br/>[spf.sh]"]
  node_spf_result["Console validation"]
end

node_operator(("Security engineer"))
node_entra[("Entra ID tenant")]
node_m365[("Microsoft 365 tenant")]
node_dns[("DNS records")]
node_sentinel[("Sentinel / Defender")]

node_operator -->|"runs"| node_ca_audit
node_ca_audit -->|"audits policies"| node_entra
node_ca_audit -->|"produces"| node_ca_report
node_operator -->|"runs"| node_ca_apps
node_ca_apps -->|"assesses apps"| node_entra
node_ca_apps -->|"produces"| node_ca_risk
node_operator -->|"runs"| node_app_audit
node_app_audit -->|"audits registrations"| node_entra
node_app_audit -->|"produces"| node_app_outputs
node_operator -->|"runs"| node_device_cleanup
node_device_cleanup -->|"audits devices"| node_entra
node_device_cleanup -->|"reports / acts"| node_device_output
node_operator -->|"runs"| node_spo_audit
node_spo_audit -->|"audits collaboration"| node_m365
node_spo_audit -->|"produces"| node_spo_report
node_operator -->|"runs"| node_exo_manager
node_exo_manager -->|"configures Exchange"| node_m365
node_operator -->|"runs"| node_planner
node_planner -->|"organizes plan"| node_m365
node_planner -->|"exports"| node_planner_backup
node_operator -->|"uses"| node_hunt
node_hunt -->|"provides"| node_hunt_queries
node_hunt -->|"provides"| node_hunt_rules
node_hunt -->|"provides"| node_hunt_iocs
node_operator -->|"hunts in"| node_sentinel
node_operator -->|"runs"| node_spf
node_spf -->|"checks record"| node_dns
node_spf -->|"prints"| node_spf_result

click node_ca_audit "https://github.com/griffin31-lab/griffin31-toolkit/blob/main/CA-Policy-Analyzer/CA-Gap-Analysis.ps1"
click node_ca_apps "https://github.com/griffin31-lab/griffin31-toolkit/blob/main/CA-Update-AffectedApps/ca-affected-apps.ps1"
click node_app_audit "https://github.com/griffin31-lab/griffin31-toolkit/blob/main/Entra-AppRegistration-Audit/entra-appregistration-audit.ps1"
click node_device_cleanup "https://github.com/griffin31-lab/griffin31-toolkit/blob/main/Entra-StaleDevices-Cleanup/stale-devices-cleanup.ps1"
click node_spo_audit "https://github.com/griffin31-lab/griffin31-toolkit/blob/main/SharePoint-Sites-Audit/SPO-Sites-Audit.ps1"
click node_exo_manager "https://github.com/griffin31-lab/griffin31-toolkit/blob/main/EXO-AppPermissions-Manager/Configure-AppPermissions.ps1"
click node_planner "https://github.com/griffin31-lab/griffin31-toolkit/blob/main/Planner-Plan-Organizer/planner-organize.ps1"
click node_hunt "https://github.com/griffin31-lab/griffin31-toolkit/tree/main/Threat-Hunting"
click node_hunt_queries "https://github.com/griffin31-lab/griffin31-toolkit/tree/main/Threat-Hunting/kql"
click node_hunt_rules "https://github.com/griffin31-lab/griffin31-toolkit/tree/main/Threat-Hunting/detection-rules"
click node_hunt_iocs "https://github.com/griffin31-lab/griffin31-toolkit/tree/main/Threat-Hunting/iocs"
click node_spf "https://github.com/griffin31-lab/griffin31-toolkit/blob/main/SPF-Lookup-Validator/spf.sh"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ca_audit,node_ca_report,node_ca_apps,node_ca_risk toneBlue
class node_app_audit,node_app_outputs,node_device_cleanup,node_device_output,node_entra,node_m365,node_dns,node_sentinel toneAmber
class node_spo_audit,node_spo_report,node_exo_manager,node_planner,node_planner_backup toneMint
class node_hunt,node_hunt_queries,node_hunt_rules,node_hunt_iocs toneRose
class node_spf,node_spf_result,node_operator toneIndigo
```

## Components

### Conditional Access

- [CA policy analyzer](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/CA-Policy-Analyzer/CA-Gap-Analysis.ps1): `CA-Policy-Analyzer/CA-Gap-Analysis.ps1`
- **CA HTML report**
- [Affected-app assessment](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/CA-Update-AffectedApps/ca-affected-apps.ps1): `CA-Update-AffectedApps/ca-affected-apps.ps1`
- **Excel risk report**

### Identity Tools

- [App registration audit](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/Entra-AppRegistration-Audit/entra-appregistration-audit.ps1): `Entra-AppRegistration-Audit/entra-appregistration-audit.ps1`
- **HTML / Excel findings**
- [Stale device cleanup](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/Entra-StaleDevices-Cleanup/stale-devices-cleanup.ps1): `Entra-StaleDevices-Cleanup/stale-devices-cleanup.ps1`
- **Device audit / actions**

### Collaboration Tools

- [SharePoint sites audit](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/SharePoint-Sites-Audit/SPO-Sites-Audit.ps1): `SharePoint-Sites-Audit/SPO-Sites-Audit.ps1`
- **Collaboration HTML report**
- [Exchange app permissions](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/EXO-AppPermissions-Manager/Configure-AppPermissions.ps1): `EXO-AppPermissions-Manager/Configure-AppPermissions.ps1`
- [Planner organizer](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/Planner-Plan-Organizer/planner-organize.ps1): `Planner-Plan-Organizer/planner-organize.ps1`
- **Local JSON backup**

### Threat Hunting

- [Hunt library](https://github.com/griffin31-lab/griffin31-toolkit/tree/main/Threat-Hunting): `Threat-Hunting`
- [KQL queries](https://github.com/griffin31-lab/griffin31-toolkit/tree/main/Threat-Hunting/kql): `Threat-Hunting/kql`
- [Detection rules](https://github.com/griffin31-lab/griffin31-toolkit/tree/main/Threat-Hunting/detection-rules): `Threat-Hunting/detection-rules`
- [Indicators of compromise](https://github.com/griffin31-lab/griffin31-toolkit/tree/main/Threat-Hunting/iocs): `Threat-Hunting/iocs`

### Other Utilities

- [SPF lookup validator](https://github.com/griffin31-lab/griffin31-toolkit/blob/main/SPF-Lookup-Validator/spf.sh): `SPF-Lookup-Validator/spf.sh`
- **Console validation**

### Other components

- **Security engineer**
- **Entra ID tenant**
- **Microsoft 365 tenant**
- **DNS records**
- **Sentinel / Defender**

## Connections

- Security engineer → CA policy analyzer: runs
- CA policy analyzer → Entra ID tenant: audits policies
- CA policy analyzer → CA HTML report: produces
- Security engineer → Affected-app assessment: runs
- Affected-app assessment → Entra ID tenant: assesses apps
- Affected-app assessment → Excel risk report: produces
- Security engineer → App registration audit: runs
- App registration audit → Entra ID tenant: audits registrations
- App registration audit → HTML / Excel findings: produces
- Security engineer → Stale device cleanup: runs
- Stale device cleanup → Entra ID tenant: audits devices
- Stale device cleanup → Device audit / actions: reports / acts
- Security engineer → SharePoint sites audit: runs
- SharePoint sites audit → Microsoft 365 tenant: audits collaboration
- SharePoint sites audit → Collaboration HTML report: produces
- Security engineer → Exchange app permissions: runs
- Exchange app permissions → Microsoft 365 tenant: configures Exchange
- Security engineer → Planner organizer: runs
- Planner organizer → Microsoft 365 tenant: organizes plan
- Planner organizer → Local JSON backup: exports
- Security engineer → Hunt library: uses
- Hunt library → KQL queries: provides
- Hunt library → Detection rules: provides
- Hunt library → Indicators of compromise: provides
- Security engineer → Sentinel / Defender: hunts in
- Security engineer → SPF lookup validator: runs
- SPF lookup validator → DNS records: checks record
- SPF lookup validator → Console validation: prints