// tools/investigator

Sign-in Investigator

Drop in an Entra sign-in log export and watch it replay on a 3D globe. It finds password spray, brute force, MFA fatigue, impossible travel and legacy authentication, then gives you the evidence, the KQL to hunt for it and the steps to contain it.

Open a sign-in export Runs in your browser. Your logs are never uploaded.

JSON or CSV from the Entra admin centre, Graph PowerShell or Log Analytics. You can also drop the file anywhere on the page.

0Sign-ins

0Accounts

0Countries

0IP addresses

0Failed

0Findings

successMFA or interruptedfailedjourneyattack

⇪

Drop a sign-in log export here or see it in action with a realistic attack on a fictional company

Drop to investigate

follow attacks

Get your sign-in logs

Entra admin centre (quickest)

Go to Entra ID › Monitoring & health › Sign-in logs, set the date range and filters, then choose Download › Download JSON. JSON includes the coordinates for each sign-in, so everything shows on the globe. CSV works too, but it has no coordinates, so those sign-ins count towards the findings without appearing on the map.

Microsoft Graph PowerShell

Needs AuditLog.Read.All and an Entra ID P1 or P2 licence.

powershell4 lines

1
2
3
4Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"
$since = (Get-Date).ToUniversalTime().AddDays(-3).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "createdDateTime ge $since" -All |
    ConvertTo-Json -Depth 8 | Set-Content signins.json

Log Analytics or Sentinel

Run this, then export the results as CSV. The LocationDetails column carries the coordinates.

kql3 lines

1
2
3SigninLogs
| where TimeGenerated > ago(3d)
| project TimeGenerated, UserPrincipalName, UserDisplayName, IPAddress, LocationDetails, ResultType, ResultDescription, ClientAppUsed, AppDisplayName, RiskLevelDuringSignIn, ConditionalAccessStatus

What it looks for

Finding	Rule
Password spray	One IP address with wrong or locked-out passwords (50126, 50053) for 5 or more accounts within an hour. Critical if any of those accounts then gets past the password from that IP.
Brute force	10 or more wrong passwords for one account within 30 minutes. Critical if the same IP then gets past the password.
MFA fatigue	3 or more failed or denied MFA prompts (500121) for one account within 30 minutes. Critical if a sign-in from the same IP then succeeds.
Impossible travel	Two sign-ins that got past the password, from different IPs more than 500 km apart, faster than 900 km/h.
Legacy authentication	Successful sign-ins from anything other than a browser or a modern app, such as IMAP, POP or SMTP. These can't do MFA.
Risky sign-in	Entra ID Protection rated the sign-in medium or high risk. Needs Entra ID P2 data.
New country	An account's first successful sign-in from a country, after at least 8 sign-ins from elsewhere.

This is a quick triage tool, not a replacement for Entra ID Protection or Microsoft Sentinel. Locations come from IP addresses, so VPNs and mobile networks can place people in the wrong city. The sample data is made up: contoso.com, documentation IP ranges and invented people.