Where the analysis happens
The product ships as a single Azure VM described by an ARM template. Deployment creates the VM in your subscription, cloud-init brings up the stack with docker compose, and Caddy issues a Let's Encrypt certificate against the Azure-assigned FQDN. That FQDN is what Microsoft Graph calls back to. The mailbox content being scored is processed there, on infrastructure inside your own tenant, rather than being routed to a vendor's multi-tenant service for inspection.
How it connects to Microsoft 365
Vaikora subscribes to Microsoft Graph change notifications, so it sees mail as it arrives rather than sitting in the delivery path as an MX-record hop. There is no mail-flow cutover and no MX change: the deployment finishes, an administrator grants AAD admin consent to the managed identity the template created, and the webhook starts receiving notifications. Removing it is equally undramatic, because nothing was ever rerouted.
What is doing the detecting
The VM bundles Data443's detection engine alongside ClamAV for file analysis and a local model server for classification work. The engine is the same lineage that Data443 operates at scale for mail providers, run here per tenant instead of as a shared service. Because the model server is local to the VM, message text used for classification is scored in place.
Evidence your SOC already knows how to read
The deployment provisions Azure Monitor and Microsoft Sentinel resources, including a workbook and analytic rules. Detections arrive as Sentinel data rather than in a separate vendor console nobody watches, which means existing hunting queries, incident workflows and retention policies apply without new tooling.
Who this is for
Organisations whose data-residency, sovereignty or contractual position makes routing mail through another vendor's cloud difficult, and security teams that would rather run detection inside the tenant boundary they already audit. It is additive to Microsoft's own filtering rather than a replacement for the mail platform.