Exporting from Purview

Corelog takes exactly one input: a CSV export from Microsoft Purview Audit Search.

Producing the export

1. Open the Microsoft Purview compliance portal and go to Audit.
2. Run an Audit Search for the date range and users under investigation. Leave the activity filter empty unless you already know what you are looking for — several detections work by comparing a user against their own baseline, and filtering the export narrows that baseline.
3. When the search completes, export the results as CSV.
4. Drop the file onto Corelog. Nothing is uploaded; the file is read in your browser.

Choosing a date range

The range matters more than most people expect, because several detections need history to have something to compare against.

Analysis	Minimum range	Why
Most detections	any	They evaluate events directly, with no baseline
Unusual day for user	~3 weeks	Needs about three samples of each weekday, per user
Behavior shifts	~1 week	Needs at least 7 daily buckets to split a series at all

If a range is too short, Corelog reports that rather than returning an empty result. An export of a few days is perfectly usable for incident triage; it simply cannot support the baseline-driven analyses, and the tool will tell you so instead of implying an all-clear.

For a first look at a tenant, four to six weeks is a good default: long enough for the baseline detections to work, short enough to export comfortably.

A note on volume

Purview exports get large quickly. Corelog accepts files up to 1 GB and has been exercised on exports of ~180,000 events without trouble. If the portal refuses to export your range, split it by date and analyse the parts separately — but bear in mind that splitting also splits the baselines.