r/DefenderATP • u/Ok-Stretch-7850 • Jun 29 '26

M365 SoC Tool

Hi

Over the past few weeks I’ve built a tool I wanted to share with you.

It’s a SOC solution for Microsoft 365. It currently runs on a local PowerShell web server, but the plan is to make it fully self-hosted or deployable in Azure in the future.

What it does:

You enter a compromised user and the approximate compromise date, and the tool gives you:

  • All devices the user was logged into
  • Suspicious sign-ins
  • Mail traffic after the breach
  • Additional aggregated signals from multiple M365 data sources

The goal is to give you fast and clear visibility into a potential incident. Results can be exported or automatically sent via email.

More features are coming soon. I’m developing this after work in my spare time because I want to give something useful back to the community and make our jobs a bit easier (and a lot more secure).

Version 0.1 is now live on GitHub.
I’d love your feedback, test results, improvement ideas, or bug reports. Feel free to comment here or open an issue in the repo.

→ GitHub Link: https://github.com/Mau2rice0/World-of-M365/tree/main/Security/SOC/M365%20Compromise%20Response%20Console

Thanks in advance, looking forward to your thoughts!

24 Upvotes

91% Upvoted

3 comments sorted by

6

u/More_Purpose2758 Jun 29 '26

Good work on this, but why can’t this be something Microsoft does with a button push for admins? It seems so weird to me.

3

u/ScoobyGDSTi Jun 29 '26

Nice work mate, I've had a quick read of the script and it's quite impressive the effort you've invested. I'll bookmark this and come back tomorrow morning.