Product
Evidence you can analyze
Windows event logs, Sysmon, Defender exports, Entra sign-ins and suspicious email. Each format below says what PastePile accepts, what it checks, and what it does not claim.
5 entries
- Endpoint
Windows Event Log (EVTX) analysis
Upload Windows EVTX files, including Security, System and Sysmon channels, and get a timeline, cited findings for persistence, encoded PowerShell and log clearing, with hunt queries where a finding has a follow-up.
- Endpoint
Sysmon log analysis
Analyze Sysmon event logs for process creation, network connections and registry changes. Get cited findings, a timeline and hunt queries in KQL, SPL, ES|QL and Sigma.
- Identity
Microsoft Entra sign-in log analysis
Upload Entra ID sign-in logs as CSV or JSON. Common error codes are mapped to their documented meaning and others are shown by number; many accounts tried from one source and failures followed by a success are flagged with the records cited.
- Endpoint
Microsoft Defender for Endpoint export analysis
Analyze Microsoft Defender for Endpoint advanced hunting exports (CSV or JSON). Events are mapped by ActionType into a timeline with cited findings and hunts to run back in Defender.
- Email
Phishing email and header analysis
Paste email headers or upload an .eml file. SPF, DKIM and DMARC failures, reply-to mismatches, display-name impersonation, lookalike domains, risky links and attachments are flagged without contacting any link.
Every format lands in the same case, on one timeline. See how it works, explore a synthetic demo case without an account, or compare plans.