Microsoft-Extractor-Suite

Installation

  • Prerequisites and Permissions
  • Installation

Microsoft 365 functionalities

  • Unified Audit Log
  • Unified Audit Log via Graph API
  • Date Format Notes
  • Admin Audit Log
  • Mailbox Audit Log
  • Message Trace Log
  • Inbox Rules
  • Transport Rules
  • MailItemsAccessed
  • E-mails/Attachments
  • Retrieve Mailbox Audit Status
  • Retrieve Mailbox Delegated Permissions

Azure & Entra ID functionalities

  • Activity Logs
  • Directory Activity Logs
  • Entra ID Sign-in Logs
  • Entra ID Audit Logs
  • Conditional Access Policies
  • Retrieve Device Information
  • OAuth Permissions
  • User Information
  • Identity Protection
  • Group Information
  • License Information
  • Role Management
  • Security Alerts
  • Secure Score

Additional Tools

  • Automated Evidence Collection (BETA)
  • Start-MESTriage

Project

  • About Us
  • Frequently Asked Questions
  • Known errors
Microsoft-Extractor-Suite
  • Search

© Copyright Copyright 2026 Invictus Incident Response.

Built with Sphinx using a theme provided by Read the Docs.