Forensic investigation for Microsoft 365 audit logs
Drop a Microsoft Purview Audit Search CSV export. Get a stratified activity matrix, 11 MITRE ATT&CK-mapped anomaly heuristics, geolocation mapping, and a full interactive investigation interface — instantly, in your browser.
How it works
- 01
Export from Microsoft Purview
In the Microsoft Purview compliance portal, run an Audit Search for the date range and users under investigation. Export the results as a CSV file — this is the only input Corelog requires.
- 02
Drop the CSV
Drag the file onto the upload screen or click to browse. Parsing runs entirely inside a Web Worker in your browser tab. Nothing is transmitted to any server at any point.
- 03
Investigate
Navigate the activity matrix, drill into individual events, review anomaly flags, filter by user, category, or time range, and export a Markdown investigation report for documentation or legal use.
What it detects
Eleven independent heuristics run against every loaded dataset, each mapped to a MITRE ATT&CK technique. All computation is client-side and completes in milliseconds — even on logs with hundreds of thousands of events.
Built for sensitive investigations
Audit log exports contain employee email addresses, IP addresses, device identifiers, and a complete record of every action taken in your tenant. Corelog processes everything locally: no server ever receives your data, no analytics SDK runs in the background, no CDN logs the content of your requests. Corelog is free, and it stays free — it is a web application that runs entirely in your browser, not a trial tier of something else.
Read the full privacy guaranteeWho is this for?
Incident responders
Reconstruct attacker timelines in compromised M365 tenants directly from Purview exports. No SIEM ingestion lag, no cloud account required, no data sharing.
Security analysts
Surface anomalous patterns across users, operations, and workloads in minutes. The activity matrix makes outliers visible that are invisible in raw log files.
Compliance investigators
Produce a reproducible, auditable Markdown report of findings — including exact event timestamps, operation counts, and flagged anomalies — suitable for regulatory or legal documentation.
MSSPs & consultants
Investigate client data without ingesting it into your own infrastructure. The browser-only architecture satisfies most data residency requirements by default.
Technical foundation
Built with Next.js, React, TypeScript and Tailwind CSS. Parsing runs in a dedicated Web Worker and events are queried through an in-memory DuckDB (WebAssembly) database, so the interface stays responsive on large exports. Geolocation uses a bundled TopoJSON world map with no external API calls. MITRE ATT&CK mappings are hardcoded and require no network access.
Open Corelog