# pthoor/dmarc-for-defender-xdr architecture

> Architecture diagram of the GitHub repository pthoor/dmarc-for-defender-xdr, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/pthoor/dmarc-for-defender-xdr
- Repository: https://github.com/pthoor/dmarc-for-defender-xdr

## Overview

DMARC for Defender XDR ingests aggregate (RUA) reports from an Exchange Online mailbox and turns them into telemetry for hunting and detections. The documented high-level path runs through Microsoft Graph notifications, Event Grid, Azure Functions, and Log Analytics; analysts then use Defender XDR detections and investigations, with a workbook for trends and optional Azure Monitor alerts. Function entry points and other capabilities are represented from the repository tree and README, but no source excerpts were provided to verify their internal calls or detailed processing stages.

Main entry points: [`src/function`](https://github.com/pthoor/dmarc-for-defender-xdr/tree/main/src/function) (Azure Functions), [`detections`](https://github.com/pthoor/dmarc-for-defender-xdr/tree/main/detections) (Detection rules), [`workbook/dmarc-workbook.json`](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/workbook/dmarc-workbook.json) (DMARC workbook), [`infra/alerts.bicep`](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/infra/alerts.bicep) (Monitor alerts)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ingestion["Report ingestion"]
  node_functions["Azure Functions"]
end

subgraph group_processing["Function processing"]
  node_dmarc["Report processor<br/>[run.ps1]"]
  node_catchup["Catch-up processor<br/>[run.ps1]"]
  node_backfill["Backfill processor<br/>[run.ps1]"]
  node_posture["Domain posture<br/>[run.ps1]"]
  node_subscription["Subscription renewal<br/>[run.ps1]"]
  node_setup["Setup helper<br/>[run.ps1]"]
end

subgraph group_analytics["Telemetry and analytics"]
  node_loganalytics[("Log Analytics")]
  node_workbook["DMARC workbook"]
  node_alerts["Monitor alerts<br/>[alerts.bicep]"]
end

subgraph group_security["Detection and response"]
  node_detections["Detection rules"]
end

node_exchange["Exchange Online"]
node_graph["Graph notifications"]
node_eventgrid["Azure Event Grid"]
node_defender["Defender XDR"]

node_exchange -->|"sends notifications"| node_graph
node_graph -->|"notifies"| node_eventgrid
node_eventgrid -->|"triggers"| node_functions
node_functions -->|"ingests telemetry"| node_loganalytics
node_loganalytics -->|"provides telemetry"| node_detections
node_detections -->|"supports detections"| node_defender
node_loganalytics -->|"supports analysis"| node_workbook
node_loganalytics -.->|"supports alerting"| node_alerts

click node_functions "https://github.com/pthoor/dmarc-for-defender-xdr/tree/main/src/function"
click node_dmarc "https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/DmarcReportProcessor/run.ps1"
click node_catchup "https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/CatchupProcessor/run.ps1"
click node_backfill "https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/BackfillProcessor/run.ps1"
click node_posture "https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/DomainPostureCollector/run.ps1"
click node_subscription "https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/RenewGraphSubscription/run.ps1"
click node_setup "https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/SetupHelper/run.ps1"
click node_workbook "https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/workbook/dmarc-workbook.json"
click node_alerts "https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/infra/alerts.bicep"
click node_detections "https://github.com/pthoor/dmarc-for-defender-xdr/tree/main/detections"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_functions toneBlue
class node_dmarc,node_catchup,node_backfill,node_posture,node_subscription,node_setup toneAmber
class node_loganalytics,node_workbook,node_alerts toneMint
class node_detections toneRose
class node_exchange,node_graph,node_eventgrid,node_defender toneIndigo
```

## Components

### Report ingestion

- [Azure Functions](https://github.com/pthoor/dmarc-for-defender-xdr/tree/main/src/function): `src/function`

### Function processing

- [Report processor](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/DmarcReportProcessor/run.ps1): `src/function/DmarcReportProcessor/run.ps1`
- [Catch-up processor](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/CatchupProcessor/run.ps1): `src/function/CatchupProcessor/run.ps1`
- [Backfill processor](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/BackfillProcessor/run.ps1): `src/function/BackfillProcessor/run.ps1`
- [Domain posture](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/DomainPostureCollector/run.ps1): `src/function/DomainPostureCollector/run.ps1`
- [Subscription renewal](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/RenewGraphSubscription/run.ps1): `src/function/RenewGraphSubscription/run.ps1`
- [Setup helper](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/src/function/SetupHelper/run.ps1): `src/function/SetupHelper/run.ps1`

### Telemetry and analytics

- **Log Analytics**
- [DMARC workbook](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/workbook/dmarc-workbook.json): `workbook/dmarc-workbook.json`
- [Monitor alerts](https://github.com/pthoor/dmarc-for-defender-xdr/blob/main/infra/alerts.bicep): `infra/alerts.bicep`

### Detection and response

- [Detection rules](https://github.com/pthoor/dmarc-for-defender-xdr/tree/main/detections): `detections`

### Other components

- **Exchange Online**
- **Graph notifications**
- **Azure Event Grid**
- **Defender XDR**

## Connections

- Exchange Online → Graph notifications: sends notifications (evidence: `README.md`)
- Graph notifications → Azure Event Grid: notifies (evidence: `README.md`)
- Azure Event Grid → Azure Functions: triggers (evidence: `README.md`)
- Azure Functions → Log Analytics: ingests telemetry (evidence: `README.md`)
- Log Analytics → Detection rules: provides telemetry (evidence: `README.md`)
- Detection rules → Defender XDR: supports detections (evidence: `README.md`)
- Log Analytics → DMARC workbook: supports analysis (evidence: `README.md`)
- Log Analytics → Monitor alerts: supports alerting (evidence: `README.md`)