2026.05.01

ualforge

Parse Microsoft 365 Unified Audit Log (UAL) CSV exports into a single
SQLite database optimized for digital-forensic and business-email-compromise
(BEC) investigations.

Every row of every CSV export is preserved verbatim, the JSON auditData
blob is stored both raw (byte-for-byte) and in canonical form, and a wide
set of BEC-relevant fields are promoted into indexed and normalized
columns for fast querying. Re-ingesting the same data is safe: full-row
SHA-256 hashes are used as the deduplication key.

The companion script bec-triage consumes this database to produce a BEC triage report.
See the bec-triage repo here