365Lantern 0.1.0-alpha.4 — Response connection recovery

Response recovery

Response preparation now remains available for a retained live investigation when its read-only collection connection ends. Select a collected account, action and reason, then prepare to authorize Response separately as the same administrator. No tenant change is sent before final approval.

Explicitly clearing the session removes the verified identity. Imported/demo cases, mismatched tenants, missing directory account IDs and busy operations remain blocked. Existing consent, identity/target revalidation and approval controls remain in place. A suspicious finding is not required.

Disabled-state messages explain the applicable limitation instead of always asking for another live investigation.

Validation

447 automated checks and packaged UI smoke tests passed. The maintainer confirmed the version works after live testing with a correctly identified directory account. The installer contains that same application payload and is published unchanged from the test candidate. Its embedded provenance identifies the development base and candidate status; the source validation record documents this explicitly.

Download

Download the unsigned per-user 365Lantern-0.1.0-alpha.4-Setup.exe and its SHA-256 checksum. No administrator elevation is required; Windows may show an unknown-publisher warning. Export your current evidence before closing the application and updating.

365Lantern 0.1.0-alpha.3 — Authentication reliability

Authentication reliability

• Reuse the Exchange connection across read-only collection phases. A failed Exchange authentication attempt is not automatically repeated by later checks; clear/reconnect explicitly to retry.
• Keep Connect tenant responsive while the helper starts, with Cancel visible on that screen and during collection.
• Add Use a browser sign-in code on Connect tenant. If the normal sign-in window does not appear, cancel, enable this option and retry. Lantern displays the short-lived code and a fixed Microsoft sign-in link. Existing browser windows can stay open. Graph and Exchange each authorize their own service; sign in with the same administrator account.
• Handle default-browser launch failure without crashing; the Microsoft URL can be opened manually.

Security and limits

Graph and Exchange have separate service tokens, so this does not guarantee a single prompt. Tenant consent, MFA and Conditional Access can still require interaction or prohibit device-code flow. Response actions retain separate, action-specific authorization. Codes are cleared after completion/cancellation/disconnect and are never added to exports; Lantern does not add persistent credential storage.

Validation

442 automated checks passed, including one Exchange authentication across phases, no automatic retry after a failed connection, device-code forwarding/clearing, and termination of stalled authentication. Packaged UI smoke tests and downloaded-helper startup checks passed. Automated authentication checks use synthetic modules. The maintainer then tested the replacement application live: normal sign-in and investigation succeeded with one additional browser sign-in during collection. Cancel also worked. Device-code flow was denied by Microsoft in the test tenant (530035); leave that option unchecked when tenant policy blocks it. The installer wraps the same tested application payload.

Download the unsigned per-user Setup.exe and its SHA-256 checksum below. No administrator elevation is required; Windows may show an unknown-publisher warning. Export your investigation before closing the old app and installing the update.

365Lantern 0.1.0-alpha.2 — Windows installer

Windows installer

Download 365Lantern-0.1.0-alpha.2-Setup.exe below. Installs for the current user without administrator elevation and includes .NET, PowerShell and Microsoft modules. Start menu shortcut and uninstall support are included. The installer is unsigned; Windows may show an unknown-publisher warning.

Changes

• Fix sign-in helper startup when Windows marks downloaded scripts as Internet files. The execution-policy override applies only to the helper process; enforced organizational policy remains authoritative.
• Explain blocked, missing or prematurely exited PowerShell startup without saving credentials or server error bodies.
• Add installer payload inventory verification and SHA-256 checksum.

Validation

437 automated checks, packaged application smoke tests, bundled module imports and downloaded-script startup regression passed. The maintainer tested this exact installer on the Windows VM and confirmed it works. Published installer bytes are unchanged from that test candidate; embedded provenance records the development base and candidate status. See the source validation record for scope.

Alpha software: review findings and collection gaps before drawing conclusions. Response actions require separate explicit approval in the application.

365Lantern 0.1.0-alpha.1 — Community alpha

365Lantern community alpha

Free Microsoft 365 investigation and controlled response for IT defenders.
This is an experimental alpha, not a stable or independently audited security product.

Download and start

Download the Windows x64 portable ZIP and its SHA-256 sidecar. Extract the entire
ZIP and run 365Lantern.exe. No installer, local elevation or separately installed
.NET/PowerShell is required. The application is unsigned; follow your organization's
approved software process. Do not install the laboratory signing certificate.

Start with Offline Investigation and samples/SYNTHETIC-five-failures-then-success.json.
Then follow docs/alpha-testing.md and docs/test-tenant.md for authorized tenant testing.

Included

• Sign-in, IP/location, mailbox persistence, account, audit and mail-flow investigation,
  with explicit collection gaps when licensing, permissions or APIs limit access.
• Per-account timelines, suspicious-behavior review and related-account investigation.
• Client-facing HTML incident reports plus technical JSON/CSV evidence exports.
• Separately authorized, explicitly approved experimental Response actions: session
  revocation, cloud password reset, selected MFA/passwordless-method removal and
  limited unmanaged Entra device-registration removal.
• Generated temporary passwords with private handoff; credentials excluded from reports.
• Manual GitHub update checks, system/light/dark themes, no application telemetry.
• Source commit provenance, CycloneDX inventory, per-file hashes and upstream notices.

Known limitations

No findings does not establish safety. Indicators need analyst review. Message traces
do not prove that a person opened or clicked a message. Coverage depends on Microsoft
licensing, roles, retention and APIs; noninteractive sign-ins use Microsoft Graph beta.
Response acceptance does not establish containment, and Unknown outcomes may have
changed the tenant. Verify before retrying. Test response only on disposable targets
initially. Entra device deletion is not an Intune wipe or retirement operation.

Cases and response records stay in memory until explicit export. Exports are sensitive
and not automatically encrypted; browser/broker state and tenant consent can persist
outside Lantern. See SECURITY.md and docs/privacy.md.

Validation

Source commit: ed188f5
437 automated checks, source UI checks, GitHub Windows build and packaged UI/module
import checks passed. All 1,315 inventoried payload hashes were verified, the SBOM
validated against CycloneDX 1.6, and source/history/Actions/package secret scans found
no leaks. Initial GitHub CodeQL analysis passed with no reported alerts; GitHub secret scanning and dependency alerts were also empty at release time. These checks are not a penetration test or an exhaustive dependency audit.

The maintainer confirmed this exact ZIP passed the clean Windows 11 VM checklist as a
standard user on 2026-10-01: launch, included synthetic-sample import, Microsoft
sign-in/read-only collection and report/evidence export. This does not establish live
validation of every response action or every tenant licensing configuration.

ZIP SHA-256: AB93EA8530513F6099C9DF20C9AA2BD8DE0506A8F951888A575089FD9F1E8DB0

Feedback

Use the repository's bug template with synthetic reproductions. Never upload real
tenant evidence, credentials or private screenshots. Report vulnerabilities privately
through Security → Advisories → Report a vulnerability.