The Problem PULSAR Solves
Microsoft 365 E3 provides 90 days of audit log retention, accessible only through the Microsoft Purview portal. Events older than 90 days are permanently gone. There is no alerting on admin actions, no forwarding, and no integration surface beyond Microsoft’s API.
PULSAR solves this entirely. Once deployed, audit events are continuously pulled and stored in your own MongoDB instance. Retention is indefinite. The data is yours.
What PULSAR Does
Continuous Ingestion
Polls Microsoft audit APIs on a configurable interval and stores all events incrementally. Watermarks ensure nothing is missed. Sources: Entra directory audit logs, Intune audit logs, Exchange / SharePoint / Teams via Office 365 Management Activity API.
Search & Filter UI
A web interface for searching events by workload, operation type, user, resource, and time range. Designed for the kind of investigation that is otherwise done by manually clicking through the Purview portal.
Alerting
Rules-based alerting with webhook delivery. Trigger on new permanent Global Admin assignments, CA policy changes outside business hours, guest invitations in sensitive groups, and more.
SIEM Forwarding
Forward audit events to an external SIEM. Events are normalised and enriched before forwarding — higher-quality data than a direct Microsoft API integration delivers.
MCP Server
PULSAR exposes search_events, get_event, and get_summary via the Model Context Protocol, so an AI assistant (Claude, Copilot, or any MCP-compatible client) can query your audit log in natural language.
Why This Matters
For compliance (NIS2 / GDPR Article 33): The 90-day M365 portal window does not satisfy requirements for ongoing, reliable audit log retention. PULSAR’s indefinite retention, independently controlled, satisfies supervisory authority expectations and enables the 72-hour breach notification window under GDPR.
For incident investigation: Without PULSAR, a breach investigation depends on whatever events are still within the portal window. With PULSAR, the full history is always available — even if detection was slow.
For governance evidence: Every admin action, searchable and permanent. Useful for internal reporting, audit preparation, and the team’s own situational awareness.
Architecture
PULSAR runs as a container on Azure Container Apps alongside ASTRAL. The recommended database backend for production is Azure Cosmos DB for MongoDB (vCore) — fully managed, wire-compatible, and available within your Azure region (EU data residency preserved).
Secrets are stored in Azure Key Vault and surfaced via managed identity — no credentials in environment variables.
PULSAR + ASTRAL Together
| PULSAR | ASTRAL | |
|---|---|---|
| Question answered | What happened? | What does the config look like, and what changed? |
| Data stored | Audit events | Configuration snapshots |
| Storage | MongoDB | Git repository |
| History | From deployment date | From deployment date |
Deployed together, they give the complete picture: every admin action in the audit log, and every configuration state at any point in time.
Ready to deploy PULSAR?
Full deployment documentation and Docker images are available on GitHub.