A hunt and incident response tool for gathering forensic data from Microsoft Entra ID, Azure, M365, and Defender environments.
Untitled Goose Tool is an open-source incident response and hunting tool developed by CISA for investigating Microsoft cloud environments. It collects forensic data from Microsoft Entra ID, Azure, M365, Defender for Endpoint, and Defender for IoT to help security teams analyze incidents when logs aren't available in a SIEM. The tool uses novel authentication methods and provides flexible configuration for targeted data gathering.
Incident responders, security analysts, and forensic investigators who need to collect and analyze telemetry from Microsoft cloud environments during security incidents.
Developers choose Untitled Goose Tool because it's a comprehensive, government-developed tool specifically designed for Microsoft cloud forensics, offering extensive data collection capabilities that aren't available in standard commercial tools. Its flexible configuration and automation features make it ideal for rapid incident response scenarios.
Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Collects data from Microsoft Entra ID, Azure, M365, Defender for Endpoint, and Defender for IoT, providing a unified view for investigations when logs aren't in a SIEM.
Allows selective enabling of data sources via .conf files, so teams can focus on relevant telemetry like Azure activity logs or M365 Unified Audit Logs without unnecessary overhead.
Includes autohonk for continuous authentication and data collection, plus PowerShell scripts for service principal setup, streamlining the investigation process.
Works behind corporate proxies using standard environment variables (e.g., https_proxy), ensuring it can operate in restricted network environments.
Requires creating a service principal with extensive read-only permissions across multiple Microsoft services and running PowerShell scripts, which can be time-consuming and error-prone for teams without Azure admin experience.
The README admits the tool quickly hits Microsoft's Graph API limits, causing 429 errors that can hinder data collection, with no built-in throttling or retry logic beyond user adjustments.
Designed exclusively for Microsoft ecosystems, offering no support for other cloud providers like AWS or Google Cloud, limiting its utility in hybrid or multi-cloud environments.