Corelog
Forensic investigation for Microsoft 365 audit logs. Free, no account, runs entirely in your browser.
Twelve MITRE ATT&CK-mapped detections with their full criteria, the behaviour-shift method, and how geolocation is resolved.
Stratum Labs Docs
Documentation for Stratum Labs security analytics tooling.
These pages exist for one reason: every detection our tools make should be something you can explain. Each entry states its exact threshold, its time window, the baseline it compares against and the MITRE ATT&CK technique it maps to — so a finding survives the question “why did it flag that?”
Products
Section titled “Products”Coming soon
A second product is in development. Its documentation will appear here alongside Corelog’s.
Corelog, at a glance
Section titled “Corelog, at a glance”Detection referenceAll twelve detections — counts, windows, baselines and MITRE mappings.
Behavior shiftsThe statistical change-point layer that runs alongside the rules.
GeolocationWhy Purview's GeoLocation field is not a country, and which events count as evidence of where a person was.
PrivacyWhat Corelog does with your data. Short, because the answer is nothing.