How to read this screen

Nimbus Vestige reconstructs how an intrusion most likely moved through an identity estate — and, just as importantly, tells you how much to trust each part of that story.

The core idea

This is not a detector. It doesn't tell you that something happened — it works backward from fragmented logs to reconstruct how it most likely happened, and what else plausibly could have. Every claim it makes carries a confidence score, and it refuses to assert what it can't support. Reconstructions are hypotheses, not verdicts.

Confidence & the trust floor

Every step carries a confidence between 0 and 1, earned from independent corroborating evidence (source IP, device, successful outcome, closeness in time to other steps). The trust floor slider is the threshold you demand before NV will assert something.

• Drag it up → stricter. Only heavily-corroborated steps survive. High trust, low coverage.
• Drag it down → permissive. Weaker, speculative steps develop in too. High coverage, lower trust.
• Anything below the floor is withheld — shown greyed out, never silently guessed or silently hidden.

That is the honesty-versus-coverage tradeoff, put in your hands.

Reading a step

• verified (green) — high confidence, backed by two or more independent signals.
• pattern-only (cyan) — above the floor, but a weaker or single-signal match. Plausible, not confirmed.
• withheld (grey) — below the floor. NV can see it but won't stand behind it.
• no known match — an action with no library technique, reconstructed by the abductive layer at lower confidence. This is how NV handles novel, never-seen tradecraft instead of going blind.

The three surfaces

• Embedding canvas (top) — every identity and service principal placed by similarity of behavior, not org chart or network. Entities that cluster used the same techniques; colour is suspicion, size is event volume. Click any dot to inspect it.
• Most-likely chain (left) — the single best reconstruction of the attack, grouped by ATT&CK technique. Groups with a ▸ expand to the individual literal steps the attacker took, each scored on its own.
• Ranked competing paths (right) — the other plausible ways in, ranked by likelihood. This is the antidote to anchoring on the first story you see, and the untaken-but-open doors are your hardening backlog.

Scope

The authorized scope badge means NV is only operating on an estate you're permitted to investigate — a first-class control, not decoration. The engine refuses to run on unauthorized tenants.

Connecting your own data

Everything on this screen is a public research dataset. Here's how to point Nimbus Vestige at your own Entra/M365 estate instead.

1 — Export your audit logs

NV reads the same Microsoft 365 unified audit log this demo uses. Pull it from any of:

• Microsoft Purview — Audit search, export to CSV.
• Search-UnifiedAuditLog — the Exchange Online PowerShell cmdlet, for scripted pulls.
• Microsoft Graph — the auditLogs and signIns endpoints, for a live connector.
• Sentinel / SIEM export — if you already centralize OfficeActivity and SigninLogs.

2 — Normalize it

Run the extractor to strip everything down to the identity-relevant events NV reasons over:

python3 nv_extract_identity_events.py your_audit_export.csv your_events.jsonl

It keeps sign-ins, consent grants, service-principal and role changes, and mailbox access, and drops the rest. Works on any export carrying the standard AuditData column.

3 — Reconstruct, scope-gated

The engine refuses to run on any tenant you haven't explicitly authorized — so name yours:

python3 run_nv.py your_events.jsonl reconstruction.json --authorize yourtenant.onmicrosoft.com

4 — View

The GUI renders whatever reconstruction.json the engine produced. Point it at your file and this same screen shows your incident, your entities, your confidence bands.