Hunt through Entra ID
sign-ins like a pro.
Turn raw sign-in logs into actionable security findings. Drop a log, get an award-winning workspace with detections, pivots, and reports — without a single byte leaving your device.
Everything you need. Nothing you don't.
Files are parsed in a Web Worker inside your tab. There is no backend to leak — the app can run offline.
Streaming parser, memoized aggregates, virtualized tables.
From password spray to impossible travel — tunable thresholds included.
From a suspicious IP to a full user timeline in a click. Then export a self-contained HTML report to share with your team.
Three steps. Zero setup.
CSV or JSON from Entra portal, Graph, or Log Analytics. Multiple files supported.
A Web Worker streams, deduplicates, and maps columns — no config.
Explore detections, pivot on users and IPs, then export a shareable HTML report.
Your logs.
Your machine.
Full stop.
Entra sign-in data is deeply sensitive. We don't want it, we don't collect it, and we architected the app so we can't — even by accident.
Read the technical explanation- No backendThere is nothing to send data to. The app is static assets.
- Parsed in a WorkerPapa Parse streams your file in a Web Worker. It never touches a server.
- No telemetry SDKsNo analytics, no error reporters, no third-party fetches at runtime.
- Works offlineLoad it once, disconnect, and keep working.
Ready when you are.
Load a log, explore the demo, or bring your own export. It really is that fast.