---
title: "PULSAR"
description: "Platform for Unified Log Search, Alerting & Review. Free, open-source M365 audit log ingestion with indefinite retention and AI-ready query interface."
eyebrow: "Free & Open Source"
lead: "PULSAR continuously ingests Microsoft 365 admin audit events and stores them in a database you own. Search, alert, forward to your SIEM, and query via AI — with no retention expiry."
icon: "📡"
badge:
  text: "Free & Open Source"
  color: "green"
actions:
  - label: "View on GitHub"
    url: "https://github.com/cqrenet/pulsar"
    external: true
    primary: true
  - label: "Learn about ASTRAL →"
    url: "/products/astral/"
---

## The Problem PULSAR Solves

Microsoft 365 E3 provides 90 days of audit log retention, accessible only through the Microsoft Purview portal. Events older than 90 days are permanently gone. There is no alerting on admin actions, no forwarding, and no integration surface beyond Microsoft's API.

PULSAR solves this entirely. Once deployed, audit events are continuously pulled and stored in your own MongoDB instance. Retention is indefinite. The data is yours.

## What PULSAR Does

<div class="feature-list">
  <div class="feature-item">
    <div class="feature-item-icon">📥</div>
    <div class="feature-item-body">
      <h4>Continuous Ingestion</h4>
      <p>Polls Microsoft audit APIs on a configurable interval and stores all events incrementally. Watermarks ensure nothing is missed. Sources: Entra directory audit logs, Intune audit logs, Exchange / SharePoint / Teams via Office 365 Management Activity API.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">🔍</div>
    <div class="feature-item-body">
      <h4>Search & Filter UI</h4>
      <p>A web interface for searching events by workload, operation type, user, resource, and time range. Designed for the kind of investigation that is otherwise done by manually clicking through the Purview portal.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">🔔</div>
    <div class="feature-item-body">
      <h4>Alerting</h4>
      <p>Rules-based alerting with webhook delivery. Trigger on new permanent Global Admin assignments, CA policy changes outside business hours, guest invitations in sensitive groups, and more.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">📤</div>
    <div class="feature-item-body">
      <h4>SIEM Forwarding</h4>
      <p>Forward audit events to an external SIEM. Events are normalised and enriched before forwarding — higher-quality data than a direct Microsoft API integration delivers.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">🤖</div>
    <div class="feature-item-body">
      <h4>MCP Server</h4>
      <p>PULSAR exposes <code>search_events</code>, <code>get_event</code>, and <code>get_summary</code> via the Model Context Protocol, so an AI assistant (Claude, Copilot, or any MCP-compatible client) can query your audit log in natural language.</p>
    </div>
  </div>
</div>

## Why This Matters

**For compliance (NIS2 / GDPR Article 33):** The 90-day M365 portal window does not satisfy requirements for ongoing, reliable audit log retention. PULSAR's indefinite retention, independently controlled, satisfies supervisory authority expectations and enables the 72-hour breach notification window under GDPR.

**For incident investigation:** Without PULSAR, a breach investigation depends on whatever events are still within the portal window. With PULSAR, the full history is always available — even if detection was slow.

**For governance evidence:** Every admin action, searchable and permanent. Useful for internal reporting, audit preparation, and the team's own situational awareness.

## Architecture

PULSAR runs as a container on Azure Container Apps alongside ASTRAL. The recommended database backend for production is **Azure Cosmos DB for MongoDB (vCore)** — fully managed, wire-compatible, and available within your Azure region (EU data residency preserved).

Secrets are stored in Azure Key Vault and surfaced via managed identity — no credentials in environment variables.

## PULSAR + ASTRAL Together

| | PULSAR | ASTRAL |
|---|---|---|
| **Question answered** | What happened? | What does the config look like, and what changed? |
| **Data stored** | Audit events | Configuration snapshots |
| **Storage** | MongoDB | Git repository |
| **History** | From deployment date | From deployment date |

Deployed together, they give the complete picture: every admin action in the audit log, and every configuration state at any point in time.

<div class="cta-strip">
  <h2>Ready to deploy PULSAR?</h2>
  <p>Full deployment documentation and Docker images are available on GitHub.</p>
  <div class="actions">
    <a href="https://github.com/cqrenet/pulsar" class="btn btn-primary" target="_blank" rel="noopener">View on GitHub</a>
    <a href="/products/astral/" class="btn btn-outline">Explore ASTRAL →</a>
  </div>
</div>