365LANTERN

365Lantern is a free, open-source Windows investigation and controlled response tool for Microsoft 365 defenders. Follow account activity across identity, mailbox, and tenant evidence without losing the sequence of the incident.

The account activity timeline connects available sign-ins, rule changes, audit events, and mail activity in chronological order. Findings link back to supporting evidence; suspicious behavior remains a question for the analyst, not an automatic verdict.

The public alpha supports single-account and tenant-wide collection, offline Entra sign-in JSON review, related-account searches, and explicit evidence ZIP exports with integrity hashes. Collection stays in application memory until export. Exports contain sensitive evidence and are not automatically redacted or encrypted.

The public alpha includes separately authorized, explicitly approved Response actions: revoke sessions, reset cloud passwords, remove selected MFA/passwordless methods, and remove eligible unmanaged Entra device registrations. Device removal is not an Intune wipe or retirement. Response acceptance does not establish containment; verify outcomes before retrying.

Download the Windows x64 portable ZIP from GitHub Releases. The experimental alpha also provides HTML incident reports and JSON/CSV evidence exports. Collection depends on Microsoft licensing, retention, consent, and operator permissions. Mail traces alone do not prove a click.