Self-host Vigil365

Vigil365 pulls security telemetry from Microsoft 365 — Defender XDR incidents, Entra ID risky users and sign-ins, Intune device compliance, Exchange email protection, Defender for Cloud Apps, and service health — and shows it in a unified web dashboard. Sections cover overview, identity, devices, email, incidents, compliance, alert center, service health, licenses, conditional access, tenant audit logs, and sign-in locations. The alert policy engine supports metric, activity, and anomaly rules with a complete triage workflow (acknowledge, snooze, resolve, assign, notes). Notifications route to Microsoft Teams, SMTP email, or generic webhooks with digest options. Scheduled executive digests deliver daily, weekly, or monthly with CSV attachments. Historical trends track Secure Score, risky users, and compliance over time. A recommendations hub surfaces Conditional Access gaps and sharing posture. Entity investigation combines alert and audit timelines per user or device. Role-based access control (Admin, Analyst, Viewer) includes a tamper-evident audit trail. The interface offers dark mode, responsive layout, global search, and CSV export everywhere. Deploy via a Windows installer that provisions a database, registers an Entra app, configures HTTPS, and runs as a Windows Service, or via Docker Compose with SQL Server (single-tenant) or PostgreSQL (MSP multi-tenant). Authentication uses Microsoft Entra ID via MSAL. Data stores in SQL Server or PostgreSQL 14+ with EF Core migrations. MIT licensed, version v1.1.0.