Authentication Anomaly Analyzer

Look for password spraying, unusual failure bursts, first-seen countries and impossible travel in sign-in logs, with every threshold visible and adjustable.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop sign-in logs

An Entra sign-in export, Windows Security events (4624/4625), or any CSV/JSON with a time, a user and a result column. Analysed in your browser.

Or paste sign-in records

The records are

Thresholds (every rule is adjustable)

Six rules, all in the open

Password spray: one source fails against many accounts, with only a few tries each, inside a time window. If the same source then signs in successfully, severity rises.
Brute force: many failures against one account inside a window.
Success after failures: a successful sign-in shortly after repeated failures for the same account. It is either a user who finally remembered, or someone who guessed.
Failure burst: a short period with far more failures than usual across everyone.
First-seen country: a user signs in from a country not seen during a baseline period at the start of the data. Users without enough baseline sign-ins are skipped, not guessed.
Impossible travel: two consecutive successful sign-ins whose locations are further apart than a plane could fly in the time between them. When the log has only countries, a fast change of country is reported instead, as a weaker signal.

Every finding shows the numbers that triggered it and the rule it crossed. Change any threshold and the analysis reruns instantly, without reading the file again.

Leads, not verdicts

VPN exit points, mobile carriers, cloud proxies, shared office NAT and service accounts all produce patterns that look alarming and are not. IP geolocation is approximate. Treat every finding as a question for the user or their manager, and tune thresholds to your organisation rather than trusting defaults.

Frequently asked questions

Which columns do I need?

A timestamp, a user and an outcome. A source address enables spray detection; a country enables first-seen country; latitude and longitude enable impossible travel. For unfamiliar files, map the columns after the first run.

How are outcomes read?

Words such as success, failed, denied; 0 or a non-zero sign-in error code; Windows 4624/4625. Rows whose outcome cannot be read are counted and excluded, never guessed.

Is any address looked up?

No. Location comes only from what is in your log; nothing is sent to a geolocation or reputation service.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.