# pthoor/fylgyr architecture

> Architecture diagram of the GitHub repository pthoor/fylgyr, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/pthoor/fylgyr
- Repository: https://github.com/pthoor/fylgyr

## Overview

Fylgyr scans GitHub repositories and organizations for supply-chain weaknesses, maps findings to known attack campaigns, and emits actionable reports. Its documented workflow is initiated with Invoke-Fylgyr; organization-wide policy checks are opt-in. A separate drift scan supports scheduled monitoring, and findings can be streamed to Microsoft Sentinel for operational triage. The README documents these capabilities, but no source excerpts were provided, so internal call relationships are omitted where they are not explicit in that documentation.

Main entry points: [`src/Fylgyr/Public/Invoke-Fylgyr.ps1`](https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Public/Invoke-Fylgyr.ps1) (Invoke-Fylgyr), [`src/Fylgyr/Public/Invoke-FylgyrDriftScan.ps1`](https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Public/Invoke-FylgyrDriftScan.ps1) (Invoke-FylgyrDriftScan), [`src/Fylgyr/Public/Send-FylgyrToLogAnalytics.ps1`](https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Public/Send-FylgyrToLogAnalytics.ps1) (Log Analytics sender), [`src/Fylgyr/Public`](https://github.com/pthoor/fylgyr/tree/main/src/Fylgyr/Public) (Repository checks)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Scan and assess"]
  node_scan_command["Invoke-Fylgyr<br/>[Invoke-Fylgyr.ps1]"]
  node_repo_checks["Repository checks"]
  node_org_checks["Organization checks"]
  node_attack_catalog["Attack campaign catalog<br/>[attacks.json]"]
end

subgraph group_report["Findings and reports"]
  node_report_formats["Console, JSON, SARIF"]
end

subgraph group_drift["Drift monitoring"]
  node_drift_command["Invoke-FylgyrDriftScan"]
  node_drift_checks["Drift checks"]
end

subgraph group_sentinel["Sentinel operations"]
  node_log_analytics_sender["Log Analytics sender"]
  node_sentinel_ops["Sentinel tables and alerts"]
  node_azure_monitor["Azure Monitor ingestion"]
end

node_maintainer(("Maintainer or security team"))
node_github["GitHub"]

node_maintainer -->|"starts scan"| node_scan_command
node_scan_command -->|"scans repositories"| node_github
node_scan_command -->|"checks repositories"| node_repo_checks
node_scan_command -->|"opts into"| node_org_checks
node_scan_command -->|"maps findings"| node_attack_catalog
node_scan_command -->|"emits findings"| node_report_formats
node_maintainer -->|"starts drift scan"| node_drift_command
node_drift_command -->|"monitors changes"| node_github
node_drift_command -->|"checks for drift"| node_drift_checks
node_log_analytics_sender -->|"streams findings"| node_azure_monitor
node_azure_monitor -->|"supports triage"| node_sentinel_ops

click node_scan_command "https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Public/Invoke-Fylgyr.ps1"
click node_repo_checks "https://github.com/pthoor/fylgyr/tree/main/src/Fylgyr/Public"
click node_org_checks "https://github.com/pthoor/fylgyr/tree/main/src/Fylgyr/Public"
click node_attack_catalog "https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Data/attacks.json"
click node_report_formats "https://github.com/pthoor/fylgyr/tree/main/src/Fylgyr/Private"
click node_drift_command "https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Public/Invoke-FylgyrDriftScan.ps1"
click node_drift_checks "https://github.com/pthoor/fylgyr/tree/main/src/Fylgyr/Public/Drift"
click node_log_analytics_sender "https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Public/Send-FylgyrToLogAnalytics.ps1"
click node_sentinel_ops "https://github.com/pthoor/fylgyr/tree/main/docs/sentinel"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_scan_command,node_repo_checks,node_org_checks,node_attack_catalog toneBlue
class node_report_formats toneAmber
class node_drift_command,node_drift_checks toneMint
class node_log_analytics_sender,node_sentinel_ops,node_azure_monitor toneRose
class node_maintainer,node_github toneIndigo
```

## Components

### Scan and assess

- [Invoke-Fylgyr](https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Public/Invoke-Fylgyr.ps1): `src/Fylgyr/Public/Invoke-Fylgyr.ps1`
- [Repository checks](https://github.com/pthoor/fylgyr/tree/main/src/Fylgyr/Public): `src/Fylgyr/Public`
- [Organization checks](https://github.com/pthoor/fylgyr/tree/main/src/Fylgyr/Public): `src/Fylgyr/Public`
- [Attack campaign catalog](https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Data/attacks.json): `src/Fylgyr/Data/attacks.json`

### Findings and reports

- [Console, JSON, SARIF](https://github.com/pthoor/fylgyr/tree/main/src/Fylgyr/Private): `src/Fylgyr/Private`

### Drift monitoring

- [Invoke-FylgyrDriftScan](https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Public/Invoke-FylgyrDriftScan.ps1): `src/Fylgyr/Public/Invoke-FylgyrDriftScan.ps1`
- [Drift checks](https://github.com/pthoor/fylgyr/tree/main/src/Fylgyr/Public/Drift): `src/Fylgyr/Public/Drift`

### Sentinel operations

- [Log Analytics sender](https://github.com/pthoor/fylgyr/blob/main/src/Fylgyr/Public/Send-FylgyrToLogAnalytics.ps1): `src/Fylgyr/Public/Send-FylgyrToLogAnalytics.ps1`
- [Sentinel tables and alerts](https://github.com/pthoor/fylgyr/tree/main/docs/sentinel): `docs/sentinel`
- **Azure Monitor ingestion**

### Other components

- **Maintainer or security team**
- **GitHub**

## Connections

- Maintainer or security team → Invoke-Fylgyr: starts scan (evidence: `README.md`)
- Invoke-Fylgyr → GitHub: scans repositories (evidence: `README.md`)
- Invoke-Fylgyr → Repository checks: checks repositories (evidence: `README.md`)
- Invoke-Fylgyr → Organization checks: opts into (evidence: `README.md`)
- Invoke-Fylgyr → Attack campaign catalog: maps findings (evidence: `README.md`)
- Invoke-Fylgyr → Console, JSON, SARIF: emits findings (evidence: `README.md`)
- Maintainer or security team → Invoke-FylgyrDriftScan: starts drift scan (evidence: `README.md`)
- Invoke-FylgyrDriftScan → GitHub: monitors changes (evidence: `README.md`)
- Invoke-FylgyrDriftScan → Drift checks: checks for drift (evidence: `README.md`)
- Log Analytics sender → Azure Monitor ingestion: streams findings (evidence: `README.md`)
- Azure Monitor ingestion → Sentinel tables and alerts: supports triage (evidence: `README.md`)