How pthoor/dmarc-for-defender-xdr works
DMARC for Defender XDR ingests aggregate (RUA) reports from an Exchange Online mailbox and turns them into telemetry for hunting and detections. The documented high-level path runs through Microsoft Graph notifications, Event Grid, Azure Functions, and Log Analytics; analysts then use Defender XDR detections and investigations, with a workbook for trends and optional Azure Monitor alerts. Function entry points and other capabilities are represented from the repository tree and README, but no source excerpts were provided to verify their internal calls or detailed processing stages.
Main entry points: function Azure Functions · detections Detection rules · dmarc-workbook.json DMARC workbook · alerts.bicep Monitor alerts
Components 15
Report ingestion
- Azure Functions
src/function
Function processing
- Report processor
src/function/DmarcReportProcessor/run.ps1 - Catch-up processor
src/function/CatchupProcessor/run.ps1 - Backfill processor
src/function/BackfillProcessor/run.ps1 - Domain posture
src/function/DomainPostureCollector/run.ps1 - Subscription renewal
src/function/RenewGraphSubscription/run.ps1 - Setup helper
src/function/SetupHelper/run.ps1
Telemetry and analytics
- Log Analytics
- DMARC workbook
workbook/dmarc-workbook.json - Monitor alerts
infra/alerts.bicep
Detection and response
- Detection rules
detections
Other components
- Exchange Online
- Graph notifications
- Azure Event Grid
- Defender XDR
Connections 8
- Exchange Online → Graph notifications: sends notifications
README.md - Graph notifications → Azure Event Grid: notifies
README.md - Azure Event Grid → Azure Functions: triggers
README.md - Azure Functions → Log Analytics: ingests telemetry
README.md - Log Analytics → Detection rules: provides telemetry
README.md - Detection rules → Defender XDR: supports detections
README.md - Log Analytics → DMARC workbook: supports analysis
README.md - Log Analytics → Monitor alerts: supports alerting
README.md