I built an open-source, 100% local Microsoft Entra Security Analyzer

说明与用途

IDSignal 是一个本地开源的 Microsoft Entra 安全分析器，能够检测密码喷射和 MFA 问题，而不将数据发送到外部服务。

问题

Analyzing Microsoft Entra ID (Azure AD) sign‑in logs for password sprays and MFA gaps requires tools that do not expose tenant data to third‑party cloud services.

结果

IDSignal provides automated hunting of password sprays, MFA gap detection, risk scoring, and a fast local UI without exposing data to external services.

工作流

• 1. Install Docker on the local machine or private network.
• 2. Run the container with the command: docker run -d --name idsignal -v idsignal_data:/app/data -p 4317:4317 ghcr.io/sertacanbey/idsignal:latest.
• 3. Access the interactive dashboard on port 4317 to filter logs, hunt password sprays, spot MFA gaps, and view risk scores.

证据

I built IDSignal — an open-source, zero-cloud dependency security analyzer. It runs entirely locally on your own machine (or via Docker in your private network). Your tenant data never leaves your environment.

来源

Hunts Password Sprays: Unmasks distributed attacks (Event 50126) and groups them by threat actor IPs.

来源

Spots MFA Gaps: Pinpoints users who do not have MFA configured or active on their accounts.

来源

docker run -d --name idsignal -v idsignal_data:/app/data -p 4317:4317 ghcr.io/sertacanbey/idsignal:latest

来源