Attic Triage Tool
Forensic log files from Microsoft 365
Investigating a compromised Microsoft 365 account? The Attic Triage Tool secures the forensic log files around that account. No installation, no account. You grant consent, Attic collects the log files for you and sends you a download link. Afterwards Attic revokes the access it was granted. Built on the battle-tested Microsoft Extractor Suite by Invictus Incident Response.
How it works
Four steps. Two of them are Microsoft consent screens, and they do not ask for the same thing. Read them before you agree.
Enter the email address
You enter the address of the account you have doubts about and sign in with Microsoft. That first sign-in establishes who you are. No passwords are stored or shared with Attic.
Confirm from your mailbox
You get an email with a start button. That confirms the request came from you and that you can reach the address you entered.
Grant consent
Behind that button sits a second Microsoft consent screen. That one is the consent for the collection itself. Read what it asks for before you agree.
Download the export
Attic collects the log files and sends you a download link and an email with the result. Afterwards Attic automatically revokes the access it was granted.
Where the processing happens
The collection does not run in your browser, it runs at Attic. You grant Attic consent to fetch the log files for you, and Attic sends you the result. The processing runs on an Attic backend in Azure, region West Europe. Afterwards Attic automatically revokes the access it was granted.
If you want to know what happens to the export after that before you start, ask us at [email protected] or call the incident line.
What you get
An export of log files around the account you entered, so that you have them before Microsoft clears them out.
An export, not a verdict
You get the log files as they are. The conclusion still has to come out of them, from you or from whoever runs the investigation. If you need that conclusion, call the incident line.
Collected with the Microsoft Extractor Suite
The open-source toolset by Invictus Incident Response, used by incident responders worldwide. The same engine professional investigators run.
What is in it depends on your environment
Which log files exist differs per environment, per licence and per retention period. What Microsoft no longer holds, no tool can retrieve. Hence: be quick.
Why use the Triage Tool?
When a Microsoft 365 account is compromised, every minute counts. Attackers delete evidence, set up persistence mechanisms and exfiltrate data fast. The Triage Tool helps you capture the forensic evidence before it disappears.
Completely free
No subscription, no trial, no credit card. The tool is free for anyone responding to a Microsoft 365 incident.
No installation required
You start it from any modern browser. No PowerShell modules, no local setup, no admin privileges on the investigating device.
Attic revokes the access afterwards
The collection runs at Attic, not in your browser. You grant consent for that, and afterwards Attic automatically revokes the access it was granted.
Built on proven open-source tooling
Powered by the Microsoft Extractor Suite, the same tooling used by professional incident responders worldwide, now accessible via a simple web interface.
Built on trusted foundations
The Attic Triage Tool wraps best-in-class open-source forensics tooling in a simple, secure interface.
Built on Microsoft Extractor Suite
Open-source, community-audited forensic extraction framework
By Invictus Incident Response
Dutch-based IR firm with a global reputation in cloud forensics
Used by incident responders worldwide
Trusted by security professionals in hundreds of real-world investigations
100% free, no registration
No account, no sign-up, no strings attached
Are you an IT provider or MSP?
The Triage Tool is also perfectly suited for MSPs investigating incidents at their clients. Collect the first forensic evidence quickly, without needing specialist tools on every device.
Want to go further? Combine the Triage Tool with Attic MDR for continuous threat detection across all your managed tenants, so you catch incidents before your clients even notice.
Start your forensic investigation today
The Attic Triage Tool is free and requires no installation. Secure the forensic evidence now, while Microsoft still holds it.
Need expert help? Attic's incident response team is available 24/7.