🔍

Deep Discovery

Microsoft 365 Email Discovery

Looks beyond isolated messages: tracks context across entire conversations and reports risk only after full conversation context is available.

How Deep Discovery works

Emails — Fetched from Microsoft 365 per mailbox.
Graph — Participants (nodes), domains, and who-talks-to-whom (edges) are built from conversations.
Algorithms — Centrality, communities, k-core, clustering, temporal and relationship signals.
Security summary & threats — Anomalies and risk (external domains, cold outreach, takeover, volume, etc.) are reported after the full conversation context is considered.

Graph storage (nodes & edges)

From each mailbox we build an in-memory conversation graph. What is stored today:

Node types

Participant — One per email address (sender or recipient). Attributes: message count, sent/received, ham/spam/URL counts, first/last seen, internal vs external (by domain).
Domain — One per domain (e.g. company.com). Attributes: message count, ham/spam/URL counts, participant count, first/last seen, external flag. Used for hub and spam-ratio analysis.
Email — One per message. Attributes: message ID, subject, from, to addresses, received time, conversation ID (to link messages in the same thread), sent-folder flag. Threat types detected for that email (e.g. auth_failure, sxl_high_risk_url) are stored on the node so algorithms and UI can use per-message threat context.

Edge types

Directed send — Participant A → Participant B. One edge per (sender, recipient) pair with at least one message. Attributes: message count, ham/spam/URL counts, first/last time, relationship score (used for cold outreach and anomaly detection).
From — Participant (sender) → Email. Links each email to its sender for pathfinding and threat visibility.
To — Email → Participant. Links each email to each To recipient.
CC — Email → Participant. Links each email to each CC recipient.
Reply — Email → Email. Links a message to its parent when In-Reply-To is present (same conversation thread). Enables reply-chain and propagation algorithms.

Conversations (threads) and messages-by-ID are also kept. The graph is not persisted; it is built per scan. After the scan, threat types are attached to each email node. The graph view in Investigate still renders the participant-level graph; the full node and edge set is available for algorithms.

Step 1: Enter Microsoft 365 Credentials

Application ID:

Application Secret:

Tenant ID:

Mailbox (optional): If set, domain and mailbox selection are skipped and Deep Discovery runs on this mailbox only.

Click Deep Discovery in the left panel to start onboarding and select mailboxes to scan.

Message	Threat(s)	Cause

Step 1: Enter Microsoft 365 Credentials

Step 2: Select Domains

Step 3: Select Mailboxes for Deep Discovery

Discovery Status