Azure Activity Log Parser
Paste Azure Activity Log or Entra ID sign-in and audit records to get normalized caller, operation, resource, auth and location fields, an explainable risk score, MITRE ATT&CK mapping and ready-to-paste investigation notes — entirely in your browser.
Azure log input
Paste an Activity Log record, a
{"records":[…]} export, an ARM value array, Entra ID sign-in / audit records, or JSON-lines. Parsing happens entirely in your browser.Examples:
Paste Azure Activity or Entra ID JSON, or load an example, to see the normalized summary, risk score and ATT&CK mapping.