PastePile

Evidence formats

Microsoft Entra sign-in log analysis

Export sign-in logs from the Entra admin center or Microsoft Graph and drop them into a case. PastePile maps common status error codes to their documented meaning (others are shown by number), separates failures from successes, and runs its account compromise pack. Each case gets a timeline, findings that cite the exact records behind them, a list of what the evidence cannot establish, and hunts compiled to Defender KQL, Sentinel KQL, Splunk SPL, Elastic ES|QL and Sigma for the tools you already run.

On this page

What you can upload

  • Entra sign-in logs from the portal as CSV, where nested fields arrive as JSON inside cells
  • Entra sign-in logs from Microsoft Graph as JSON
  • Microsoft 365 unified audit log records (common schema JSON/JSONL, or CSV with AuditData) as audit context
  • Entra audit logs (JSON or CSV), kept as context records you can read and cite

How to export it

  1. In the Entra admin center open Entra ID, Monitoring & health, then Sign-in logs, filter to the user or window, and Download as CSV or JSON.
  2. Audit logs download the same way from Audit logs. They are kept as context records you can read and cite; the security-information and privileged-role checks do not run on them yet.
  3. Interactive and non-interactive sign-ins export separately; include both if you have them.
  4. Downloaded times are UTC. One file holds up to 100,000 sign-in records; filter to a shorter window if you have more.

Access you need: Microsoft documents Reports Reader as the least privileged role that can view and download these logs.

Checked against Microsoft's documentation on 23 September 2026: How to download logs in Microsoft Entra ID.

What PastePile checks

  • A burst of failed sign-ins followed by a success
  • Several identities attempted from one source
  • Sign-ins from scripted or command-line clients
  • Sign-ins at hours unusual for the account and from several sources in a short window, reported as statistical signals

Every finding cites the records behind it and states what it does not establish. Statistical signals are reported as rarity within your upload and never become findings. ATT&CK mappings describe what a behavior resembles, not proof that an adversary was present.

What it does not do

  • Impossible travel is deliberately not claimed: a VPN, a corporate egress gateway or carrier NAT looks the same as a real journey. Two sources in a short window are reported as an observation for you to judge
  • An audit operation name alone does not prove success or compromise
  • Security-information changes and privileged-role assignments are not recorded in sign-in logs. The checks for them run on Windows account and group events today, not on Entra or Microsoft 365 audit records, so a case built from Entra exports lists them as not assessed

Example output

From the synthetic Entra demo case (C-0002), built from one sign-in export:

{"createdDateTime":"2026-08-25T02:14:35Z","userPrincipalName":"n.whitfield@example.com","appDisplayName":"Office 365 Exchange Online","ipAddress":"203.0.113.44","clientAppUsed":"Other clients","status":{"errorCode":50126,"failureReason":"Invalid username or password"}}
  • F-001 · 8 failed sign-ins for n.whitfield@example.com, then a success · high

All names, hosts and addresses are synthetic. Read the findings with their citations or the client report built from them. For the structure of a client-ready report, see the security incident report template.

Try it

Open the synthetic Entra sign-ins case to see the timeline, findings, unknowns and report without an account. When you are ready, create an account and compare plans.

Other evidence formats