🔍

Deep Discovery

Microsoft 365 Email Discovery

Looks beyond isolated messages: tracks context across entire conversations and reports risk only after full conversation context is available.

How Deep Discovery works

Emails — Fetched from Microsoft 365 per mailbox.
Graph — Participants (nodes), domains, and who-talks-to-whom (edges) are built from conversations.
Algorithms — Centrality, communities, k-core, clustering, temporal and relationship signals.
Security summary & threats — Anomalies and risk (external domains, cold outreach, takeover, volume, etc.) are reported after the full conversation context is considered.

Graph storage (nodes & edges)

From each mailbox we build an in-memory conversation graph. What is stored today:

Node types

Participant — One per email address (sender or recipient). Attributes: message count, sent/received, ham/spam/URL counts, first/last seen, internal vs external (by domain).
Domain — One per domain (e.g. company.com). Attributes: message count, ham/spam/URL counts, participant count, first/last seen, external flag. Used for hub and spam-ratio analysis.
Email — One per message. Attributes: message ID, subject, from, to addresses, received time, conversation ID (to link messages in the same thread), sent-folder flag. Threat types detected for that email (e.g. auth_failure, sxl_high_risk_url) are stored on the node so algorithms and UI can use per-message threat context.

Edge types

Directed send — Participant A → Participant B. One edge per (sender, recipient) pair with at least one message. Attributes: message count, ham/spam/URL counts, first/last time, relationship score (used for cold outreach and anomaly detection).
From — Participant (sender) → Email. Links each email to its sender for pathfinding and threat visibility.
To — Email → Participant. Links each email to each To recipient.
CC — Email → Participant. Links each email to each CC recipient.
Reply — Email → Email. Links a message to its parent when In-Reply-To is present (same conversation thread). Enables reply-chain and propagation algorithms.

Conversations (threads) and messages-by-ID are also kept. The graph is not persisted; it is built per scan. After the scan, threat types are attached to each email node. The graph view in Investigate still renders the participant-level graph; the full node and edge set is available for algorithms.

Microsoft 365 app setup (application creation guide)

For Deep Discovery to access domains, mailboxes, and mail you need an Azure AD app registration with the right Application permissions. Summary of steps on the Microsoft 365 / Azure side:

Create the app — Azure Portal → Microsoft Entra ID (or Azure Active Directory) → App registrations → New registration. Name it (e.g. DeepDiscovery). Choose supported account types (single- or multi-tenant). Redirect URI is not used for the app-only (client credentials) flow; you can skip it or add any value. Only add a Single-page application (SPA) redirect URI if you later enable browser-based Microsoft sign-in for the UI.
API permissions — In the app, go to API permissions → Add a permission → Microsoft Graph → Application permissions. Add: Domains.Read.All (to list domains for Step 2), User.Read.All (to list users/mailboxes), and Mail.Read (to read mail in all mailboxes). Grant admin consent for the tenant.
Client secret — Under Certificates & secrets, create a new Client secret. Copy the secret value once (it is shown only at creation). You will use it with the Application (client) ID and Directory (tenant) ID from the app Overview in the Deep Discovery credentials step.

Use the Application (client) ID as Application ID, the secret value as Application Secret, and the Directory (tenant) ID as Tenant ID when entering credentials in Step 1 above. For full deployment and authorizer setup, see the repo docs (e.g. docs/DEPLOYMENT_WITH_MICROSOFT_AUTH.md).

Step 1: Enter Microsoft 365 Credentials

Application ID:

Application Secret:

Tenant ID:

Mailbox (optional): If set, domain and mailbox selection are skipped and Deep Discovery runs on this mailbox only.

Deep Discovery architecture

Click Deep Discovery in the left panel to start onboarding and select mailboxes to scan.

Message	Threat(s)	Cause

Step 1: Enter Microsoft 365 Credentials

Step 2: Select Domains

Step 3: Select Mailboxes for Deep Discovery

Discovery Status

Deep Discovery architecture