Loading_
Loading_
Exchange and M365 mail-flow analytics that surfaced a misconfigured connector leaking 40k messages a month.
Measured outcomes
2.1B
Messages indexed
−93%
Time to diagnose delivery failure
17
Rule conflicts identified
4 hrs → 8 min
Compliance export time
Mail flow was a black box. When delivery failed, diagnosis meant exporting message traces by hand and correlating them in Excel — a process measured in hours, run after the damage was done.
The platform streams message trace, transport rule hits and connector telemetry into a queryable store with anomaly detection on top, so mail-flow problems announce themselves.
Headline result
0k
leaked messages caught
Tags
Five capabilities that define the system. Each one exists because something specific was broken.
On-prem Exchange and Exchange Online traces normalised into one timeline per message.
Baselines per connector and per domain; deviation in volume, latency or NDR rate raises an alert.
Shows which rules actually fire, how often, and where they shadow each other.
Aggregate report ingestion with per-source pass rates and spoof attempts.
Legal-hold-safe exports scoped by mailbox, date range and keyword, generated in minutes.
A streaming ingest pipeline into a columnar store, with pre-aggregated rollups powering the interactive dashboards.
3 components
Checkpointed pollers with backfill support for historical windows.
3 components
Baselines recomputed nightly per connector and sender domain.
3 components
Interactive queries over billions of rows stay sub-second via rollups.
No mystery components. Everything below is either open source or a platform you already own.
Interactive mock-ups of the shipped interface. The live environment is available during a demo session.
Volume, latency and NDR rate by connector
The running environment is available during a booked session — including a sandbox tenant you can drive yourself.
The real sequence, in order. Steps with a command are copy-pasteable.
ClickHouse cluster and Kafka via the provided Terraform module.
$terraform apply -target=module.dataplaneCreate the Graph app registration with ReportingWebService and Mail.ReadBasic.All.
Pull 90 days of historical trace to establish baselines.
$aiinfraengine mailflow backfill --days 90Route anomaly events to the SIEM and the service desk.
Published rather than hidden behind a call. Volume and multi-year terms move these numbers.
Platform
$1.20per mailbox / month
Deployment
from $46kone-time
Need this scoped against your estate? We will size it properly, in writing, within a week.
Request a quoteWe will walk you through the architecture, the trade-offs we made, and what would change for your environment.