Live in production

Ask for the evidence.
Get a defensible search, not a support ticket.

NL Search turns a plain-English request from your security team into a precise Microsoft Purview eDiscovery query or a live Graph API pull — no KQL syntax, no manual case setup, no waiting on IT.

case_0472 — sample_query.log● match found

Analyst asks

"Find all emails between Jordan Reyes and anyone at acmevendor.com mentioning 'invoice' from the last 90 days"

System generates

(from:jordan.reyes@company.com AND recipients:*@acmevendor.com) AND subjecttitle:invoice AND date:90d — ready to run in Purview

Tap the query to declassify it — this is the real KQL our engine writes, not a mockup.

Two ways to search

Built for both the audit and the fire drill.

Compliance Mode

eDiscovery, end to end

For legal holds, HR investigations, and formal PST exports where the trail has to hold up.

Plain-English request → valid Purview KQL
Auto-creates the eDiscovery case for you
One click to Run, one click to Export
Every search is reviewable before it's submitted

Live Search Mode

Answers in seconds

For the questions that can't wait on a formal case: "is this account still forwarding mail externally?"

Real-time calls straight to Microsoft Graph
No case, no export, no waiting
Same natural-language interface
Built for triage, not the record

The mechanism

Plain English in. A tenant-safe query out.

Your analyst types the request

No query language, no field names to memorize — just a description of what they're looking for, written the way they'd say it out loud.

An AI planning layer interprets it

The request is parsed into a structured plan — either Purview KQL (kql.js) for a formal case, or a Graph API call plan (claude.js) for a live lookup — depending on the mode selected.

The plan is shown before it runs

The generated query is surfaced in plain view, so the analyst can confirm scope and intent before anything touches the tenant.

It's executed against Microsoft 365

Authenticated through Azure AD (MSAL), the request either creates and runs a Purview eDiscovery search (purview.js) or queries Graph directly (graph.js) — with results and export links returned in one pass.

What's under the hood

Standard Microsoft plumbing. No new agents, no new attack surface.

Node.js + Express Microsoft Graph API Microsoft Purview Compliance Center Azure AD / MSAL auth code flow JWT session cookies Claude API — NL→KQL & NL→Graph planning Railway hosting Single-page dashboard, no client install

Ask for the evidence.Get a defensible search, not a support ticket.

Built for both the audit and the fire drill.

eDiscovery, end to end

Answers in seconds

Plain English in. A tenant-safe query out.

Your analyst types the request

An AI planning layer interprets it

The plan is shown before it runs

It's executed against Microsoft 365

Standard Microsoft plumbing. No new agents, no new attack surface.

Search that used to take a ticket now takes a sentence.

Ask for the evidence.
Get a defensible search, not a support ticket.