DFIR Report Generator

M365 / Entra ID incident response · eusebio@it-sec

Incident details

Organisation / tenant name

Tenant domain

Incident date

Report date

Incident reference

Incident type

Status

Severity

Handling (TLP)

Analyst / responder

Scope & business impact

Data sensitivity involved

Regulatory / compliance exposure

Affected accounts

Affected users (one per line)

Compromised account type

Attack origin (IP / location)

Incident timeline

Initial compromise

Detection / alert

Containment

Eradication completedUse YYYY-MM-DD HH:MM to auto-compute dwell / response metrics

Indicators of compromise

IOCs (one per line — type: value)

M365 / Entra ID findings

Legacy Authentication EnabledAllows bypass of MFA via older auth protocols (IMAP, SMTP, POP3)

CRITICAL

MFA Not EnforcedOne or more accounts operating without MFA enforcement

CRITICAL

Conditional Access GapCA policy missing — sign-ins from untrusted locations allowed

HIGH

Suspicious Sign-In ActivitySign-ins from anomalous IPs, impossible travel, or Tor/VPN

HIGH

Inbox Rule ManipulationAttacker-created inbox rules forwarding or deleting mail

HIGH

OAuth App Consent AbuseMalicious third-party app granted delegated permissions

HIGH

Privilege EscalationAccount elevated to Global Admin or privileged role

CRITICAL

Data Exfiltration via SharePointUnusual bulk downloads or external sharing activity

HIGH

Exchange Transport Rule AddedNew mail flow rule forwarding externally

HIGH

Audit Log DisabledUnified audit log was disabled during incident window

MEDIUM

Password Spray / Brute ForceHigh volume failed sign-in attempts detected

MEDIUM

Guest Access UnrestrictedExternal guest invitations not governed by policy

MEDIUM

Response & root cause

Containment / eradication actions takenOptional — leave blank to use standard IR actions

Root cause

Additional context

Executive summary notes

Evidence / log sources

■ Generating report...

DFIR

eusebio@it-sec:~/tools/dfir-gen$ awaiting input

Fill in the form and click Generate

or load a sample to see a full enterprise report