# mdecrevoisier/microsoft-eventlog-mindmap architecture

> Architecture diagram of the GitHub repository mdecrevoisier/microsoft-eventlog-mindmap, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mdecrevoisier/microsoft-eventlog-mindmap
- Repository: https://github.com/mdecrevoisier/microsoft-eventlog-mindmap

## Overview

This repository is a reference library of five Microsoft event-log and auditing mind maps, rather than a software runtime. Defenders consult the maps to understand available log sources and auditing capabilities for collection, threat hunting, incident response, forensics, and troubleshooting. The Exchange email-compromise map focuses on hunting abused email rules. The PDFs are listed in the tree, but their contents were not sampled; descriptions and relationships here rely on the README.

Main entry points: [`windows-auditing-baseline-map/windows-auditing-baseline-map.pdf`](https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/windows-auditing-baseline-map/windows-auditing-baseline-map.pdf) (Windows OS baseline), [`windows-server-roles-map/windows-server-roles-map.pdf`](https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/windows-server-roles-map/windows-server-roles-map.pdf) (Server roles auditing), [`active-directory-map/active-directory-map.pdf`](https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/active-directory-map/active-directory-map.pdf) (Active Directory auditing), [`exchange-server-map/exchange-server-map.pdf`](https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/exchange-server-map/exchange-server-map.pdf) (Exchange Server logs)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_windows_auditing["Windows auditing"]
  node_windows_baseline["Windows OS baseline"]
  node_server_roles["Server roles auditing"]
  node_active_directory["Active Directory auditing"]
end

subgraph group_exchange["Exchange"]
  node_exchange_logs["Exchange Server logs"]
  node_email_hunting["Email rule hunting"]
end

node_defender(("Defender"))

node_defender -->|"consults"| node_windows_baseline
node_defender -->|"consults"| node_server_roles
node_defender -->|"consults"| node_active_directory
node_defender -->|"consults"| node_exchange_logs
node_defender -->|"consults"| node_email_hunting

click node_windows_baseline "https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/windows-auditing-baseline-map/windows-auditing-baseline-map.pdf"
click node_server_roles "https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/windows-server-roles-map/windows-server-roles-map.pdf"
click node_active_directory "https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/active-directory-map/active-directory-map.pdf"
click node_exchange_logs "https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/exchange-server-map/exchange-server-map.pdf"
click node_email_hunting "https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/exchange-email-compromise-map/exchange-email-compromise.pdf"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_windows_baseline,node_server_roles,node_active_directory toneBlue
class node_exchange_logs,node_email_hunting toneAmber
class node_defender toneIndigo
```

## Components

### Windows auditing

- [Windows OS baseline](https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/windows-auditing-baseline-map/windows-auditing-baseline-map.pdf): `windows-auditing-baseline-map/windows-auditing-baseline-map.pdf`
- [Server roles auditing](https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/windows-server-roles-map/windows-server-roles-map.pdf): `windows-server-roles-map/windows-server-roles-map.pdf`
- [Active Directory auditing](https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/active-directory-map/active-directory-map.pdf): `active-directory-map/active-directory-map.pdf`

### Exchange

- [Exchange Server logs](https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/exchange-server-map/exchange-server-map.pdf): `exchange-server-map/exchange-server-map.pdf`
- [Email rule hunting](https://github.com/mdecrevoisier/microsoft-eventlog-mindmap/blob/main/exchange-email-compromise-map/exchange-email-compromise.pdf): `exchange-email-compromise-map/exchange-email-compromise.pdf`

### Other components

- **Defender**

## Connections

- Defender → Windows OS baseline: consults
- Defender → Server roles auditing: consults
- Defender → Active Directory auditing: consults
- Defender → Exchange Server logs: consults
- Defender → Email rule hunting: consults