Skip to main content
Stratum Labs
Browser-only · No account · No upload required

Forensic investigation for Microsoft 365 audit logs

Drop a Microsoft Purview Audit Search CSV export. Get a stratified activity matrix, 11 MITRE ATT&CK-mapped anomaly heuristics, geolocation mapping, and a full interactive investigation interface — instantly, in your browser.

Open CorelogFree. No account. Nothing to install.

How it works

  1. 01

    Export from Microsoft Purview

    In the Microsoft Purview compliance portal, run an Audit Search for the date range and users under investigation. Export the results as a CSV file — this is the only input Corelog requires.

  2. 02

    Drop the CSV

    Drag the file onto the upload screen or click to browse. Parsing runs entirely inside a Web Worker in your browser tab. Nothing is transmitted to any server at any point.

  3. 03

    Investigate

    Navigate the activity matrix, drill into individual events, review anomaly flags, filter by user, category, or time range, and export a Markdown investigation report for documentation or legal use.

What it detects

Eleven independent heuristics run against every loaded dataset, each mapped to a MITRE ATT&CK technique. All computation is client-side and completes in milliseconds — even on logs with hundreds of thousands of events.

Impossible Travel
T1078High
Off-Hours Access
T1078.004Medium
Bulk Operations
T1567 / T1485High / Critical
Unmanaged Device
T1078Medium
New Geography
T1078Medium
First-Time Application
T1550Low
New Device
T1078Medium
External Sharing Burst
T1567.002High
Mailbox Forwarding Rule
T1114.003Critical
Audit Log Tamper
T1562.008Critical
Authentication Anomaly Cluster
T1110High
Full detection criteria, thresholds and windows

Built for sensitive investigations

Audit log exports contain employee email addresses, IP addresses, device identifiers, and a complete record of every action taken in your tenant. Corelog processes everything locally: no server ever receives your data, no analytics SDK runs in the background, no CDN logs the content of your requests. Corelog is free, and it stays free — it is a web application that runs entirely in your browser, not a trial tier of something else.

Read the full privacy guarantee

Who is this for?

Incident responders

Reconstruct attacker timelines in compromised M365 tenants directly from Purview exports. No SIEM ingestion lag, no cloud account required, no data sharing.

Security analysts

Surface anomalous patterns across users, operations, and workloads in minutes. The activity matrix makes outliers visible that are invisible in raw log files.

Compliance investigators

Produce a reproducible, auditable Markdown report of findings — including exact event timestamps, operation counts, and flagged anomalies — suitable for regulatory or legal documentation.

MSSPs & consultants

Investigate client data without ingesting it into your own infrastructure. The browser-only architecture satisfies most data residency requirements by default.

Technical foundation

Built with Next.js, React, TypeScript and Tailwind CSS. Parsing runs in a dedicated Web Worker and events are queried through an in-memory DuckDB (WebAssembly) database, so the interface stays responsive on large exports. Geolocation uses a bundled TopoJSON world map with no external API calls. MITRE ATT&CK mappings are hardcoded and require no network access.

Open Corelog