I built an open-source, 100% local Microsoft Entra Security Analyzer

Описание и применение

IDSignal – открытый локальный анализатор безопасности Microsoft Entra, который выявляет распределённые атаки паролями и пробелы MFA без передачи данных в облако.

Задача

Analyzing Microsoft Entra ID (Azure AD) sign‑in logs for password sprays and MFA gaps requires tools that do not expose tenant data to third‑party cloud services.

Результат

IDSignal provides automated hunting of password sprays, MFA gap detection, risk scoring, and a fast local UI without exposing data to external services.

Рабочий процесс

• 1. Install Docker on the local machine or private network.
• 2. Run the container with the command: docker run -d --name idsignal -v idsignal_data:/app/data -p 4317:4317 ghcr.io/sertacanbey/idsignal:latest.
• 3. Access the interactive dashboard on port 4317 to filter logs, hunt password sprays, spot MFA gaps, and view risk scores.

Доказательства

I built IDSignal — an open-source, zero-cloud dependency security analyzer. It runs entirely locally on your own machine (or via Docker in your private network). Your tenant data never leaves your environment.

Источник

Hunts Password Sprays: Unmasks distributed attacks (Event 50126) and groups them by threat actor IPs.

Источник

Spots MFA Gaps: Pinpoints users who do not have MFA configured or active on their accounts.

Источник

docker run -d --name idsignal -v idsignal_data:/app/data -p 4317:4317 ghcr.io/sertacanbey/idsignal:latest

Источник