# SysClaw

> Desktop, local-first Microsoft 365 security posture, audit and operations application. Free forever with no user limit; 30-day trial of everything on install.

## Summary
SysClaw is a desktop application for Microsoft 365 administrators, security teams, and compliance owners. It connects from the user's machine to Microsoft 365 through Microsoft Graph and Exchange Online using delegated sign-in. Tenant configuration, audit records, findings, and reports are processed and stored on that machine. No tenant data is sent to SysClaw's servers. Runs on Windows, macOS, and Linux.

## Core Entity
- **SysClaw**: Microsoft 365 security posture, audit, and operations product. SysClaw Desktop is the shipping edition; SysClaw Cloud is planned and not yet available.

## Commercial model
- Every install starts with a 30-day trial of every feature, no credit card.
- After the trial the application becomes Community Edition: free forever, no user limit, one tenant, one operator (extra seats are an add-on). Community includes every report and dashboard, all management actions, auditing with unlimited local retention, custom event alert rules with email and Teams notifications, all scheduling and every export format including Excel and PDF.
- Pro (from $490/year) adds licence and cost optimization, posture analysis and executive summaries, CIS Microsoft 365 and CISA SCuBA baselines with compliance findings and drift trends, automated playbooks and remediation, approval queues and policy guardrails, work queues and cross-tenant operations, audit compaction, white-label branding, and unlimited tenants and operators.
- Defend (from $990/year, stacks on Pro) adds the Security Threats dashboard, MITRE ATT&CK mapped detections, an incident workbench, session timelines, blast-radius analysis, watchlists and suppressions, and supervised containment actions.
- Estates over 10,000 users under management are quoted.
- Paid tiers are banded by total users under management across all connected tenants, billed annually with an offline licence key.

## Key Capabilities
1. **Tenant Inventory**: Entra ID users, roles, groups, guests, Teams, SharePoint sites, mailboxes, licenses, and enterprise applications.
2. **Security Posture Assessment**: MFA, Conditional Access, authentication methods, legacy authentication, and privileged roles, scored against the SysClaw M365 Security Baseline (Standard and Strict) and CISA SCuBA. Each check is marked automated, partial, or manual. SysClaw assesses against baselines; it does not certify compliance.
3. **Configuration Drift**: what changed between scans, which control started failing, and when.
4. **Audit Collection**: sign-ins, admin operations, Exchange, SharePoint, and Teams activity, stored locally with unlimited retention on every tier — beyond Microsoft's own retention window.
5. **Threat Detection and Investigation** (Defend): rule-based detections mapped to MITRE ATT&CK, incident grouping, session timelines. Detection is bound by Microsoft's audit-log ingestion delay and SysClaw's scan cadence; it is not real-time.
6. **Supervised Response Actions** (Defend): session revocation, account disable, inbox-rule deletion, OAuth consent revocation, with an audit trail.
7. **Reports and Exports**: CSV, Excel, HTML, and PDF generated on the local machine.

## Key Links
- Homepage: https://sysclaw.com/
- Download and trial: https://sysclaw.com/download/
- Pricing: https://sysclaw.com/pricing/
- Buy a licence (self-serve, card, invoice on request): https://sysclaw.com/buy/
- Comparison with AdminDroid, ManageEngine M365 Manager Plus, CoreView, CIPP, Maester: https://sysclaw.com/compare/
- SysClaw vs AdminDroid: https://sysclaw.com/compare/admindroid/
- SysClaw vs ManageEngine M365 Manager Plus: https://sysclaw.com/compare/manageengine-m365-manager-plus/
- SysClaw vs CoreView: https://sysclaw.com/compare/coreview/
- SysClaw vs CIPP: https://sysclaw.com/compare/cipp/
- SysClaw vs Maester and ScubaGear: https://sysclaw.com/compare/maester-scubagear/
- Microsoft 365 Auditing & Security Blog: https://sysclaw.com/blog/
- Guide (Runbook) — Audit Microsoft 365 Without Entra ID P1, P2 or E5: https://sysclaw.com/blog/audit-microsoft-365-without-entra-id-p1-or-e5/
- Guide (Runbook) — Microsoft 365 Audit Log Retention Beyond 180 Days Without E5: https://sysclaw.com/blog/microsoft-365-audit-log-retention-beyond-180-days/
- Network access and egress list: https://sysclaw.com/security/network-access/
- Demo request: https://sysclaw.com/demo/
- Contact: https://sysclaw.com/contact/
- Privacy: https://sysclaw.com/legal/privacy/
- Terms: https://sysclaw.com/legal/terms/
- Security contact: https://sysclaw.com/.well-known/security.txt