Identity Anomaly Finder
Paste Okta, Entra ID or CloudTrail sign-in and API logs. Each user's own history becomes the baseline, and the rest is scored for impossible travel, password spray, MFA fatigue, new countries, networks and devices, off-hours sign-ins and novel cloud API calls.
Generated sample data. Every user, IP and account in it is made up.
Your logs never leave this tab. Sign-in records hold names, IPs and locations, so nothing is uploaded or saved.
Tuning
How the anomaly checks work
Records are recognised per line: Okta by eventType, Entra ID by userPrincipalName with a status code, CloudTrail by eventSource and eventName. Each becomes one normalised event with time, user, IP, place, network, device family, action and outcome. Scores add up per user into the risk table; 60 or more is high and 30 to 59 is medium.
Identity anomaly FAQ
Are my logs uploaded?
No. Parsing, baselines and scoring all run in JavaScript on this page. Sign-in logs hold names, IP addresses and locations, so nothing is sent or stored.
How is the baseline built?
By default the first 70 percent of the time span in your file is the learning window. For each user the page records countries, networks (ASNs), device types, apps, active hours and, for CloudTrail, the API actions they call. Sign-ins and calls in the remaining 30 percent are scored against that user's own history. Choose All vs all to score every event against the whole file instead.
Why did a VPN hop or a real trip not alert?
Impossible travel needs both a distance over 500 km and a speed over 900 km/h, so a long-haul flight with a normal gap passes. A hop between two networks that at least four users signed in from during the baseline, such as an office and a corporate VPN egress, is skipped and counted on the page. Both thresholds can be changed.
Which log formats work?
Okta System Log JSON from the API or an export, Microsoft Entra ID sign-in logs from Microsoft Graph (auditLogs/signIns) or a Log Analytics SigninLogs export, and AWS CloudTrail files with a Records array. A JSON array or one JSON object per line both work, and the formats can be mixed in one paste.
Can this replace a UEBA product?
It covers the core baselines a UEBA starts from, on one file at a time. A production UEBA keeps months of history, peer groups and identity context, and runs continuously. Use this page to triage an export, test thresholds, or learn how the detections behave.
Field names follow the Okta System Log, Microsoft Graph signIn and AWS CloudTrail record formats as of October 2026. The sample data on this page is generated and fictional.