Offline Microsoft 365 forensic triage for exported CSV logs (UAL + Entra ID sign-ins). Generates a court-friendly, evidence-focused HTML report and SQLite dataset with suspicious activity findings no Microsoft APIs required.

🔍 Automate forensic triage of Microsoft 365 logs, generating a normalized dataset and a court-friendly report for swift incident response.

Simulated Microsoft 365 post compromise behavior using inbox rule abuse and OAuth consent persistence, validated evidence in Purview Audit and Entra audit logs, documented remediation and re validation workflow.