how to cite fatcousin
use these templates when referencing a fatcousin tool run, a session export, or a .fc-case archive in reports, legal filings, affidavits, or academic papers. replace bracketed placeholders with values from the tool footer, reproducibility receipt, or session export.
tool version format
every forensics tool page shows a version footer: slug · v[semver] · build [sha]. the build sha is NEXT_PUBLIC_BUILD_SHA — a short git commit identifier for the deployed site build. cite both semver and build sha so a reader can correlate output with the exact compiled engine.
- tool url:
https://fatcousin.com/tools/okta-log-analyzer - version line:
okta-log-analyzer · v1.0.0 · build [build_sha] - run timestamp: always UTC — match the reproducibility receipt or session custody log
session export citation
sessions at /forensics/sessions capture multiple tool runs with custody events. the export package downloads four artifacts: .fc-case archive, exhibit html, reproducibility report, and an examiner declaration template (.txt). a second row emits five interop formats — universal csv, axiom csv, stix 2.1 bundle, misp event json, and the autopsy ingest module — all generated client-side with chain-of-custody references back to the source session. cite the session id and export filename; attach the declaration template as an exhibit draft for counsel review — not as filed evidence on its own.
stix 2.1 and misp event citation
when importing a stix bundle or misp event into a siem, threat-intel platform, or case management system, cite both the export file and the source .fc-case archive. stix bundles carry x_fatcousin_coc_hash (sha256 of the canonical custody log) on the tool and incident objects; misp events carry an equivalent fatcousin:coc-hash tag and an internal-reference attribute. these anchors let a reviewer trace any observable back to the exact session manifest and replay fixture goldens at /forensics/proof to verify engine behavior.
- stix filename pattern:
fatcousin-[session_id]-stix21.json - misp filename pattern:
fatcousin-[session_id]-misp.json - custody-log sha256: copy from the export metadata or the
fatcousin:coc-hashmisp tag /x_fatcousin_coc_hashstix property - all misp attributes ship with
to_ids: false— triage findings, not active blocking intel
.fc-case archive reference
a .fc-case file is a zip archive: manifest.json, manifest.sha256 (sha256sum format sidecar), custody log, optional Ed25519 signatures, and per-run JSON receipts. import at /forensics/sessions to verify tamper status before citing contents.
copy-paste templates
example tool: okta log analyzer. replace bracketed tokens before filing.
plain english · single tool run
FatCousin Labs Inc., okta log analyzer (https://fatcousin.com/tools/okta-log-analyzer), version 1.0.0, build [build_sha], accessed May 28, 2026. Analysis performed locally in the examiner's browser; no evidence was transmitted to the operator. Input file "[input_filename]" (SHA-256: [input_sha256]); output digest SHA-256: [output_sha256]. Run timestamp (UTC): 2026-05-28 14:32:00 UTC.
apa 7 · software
FatCousin Labs Inc.. (2026). okta log analyzer (Version 1.0.0, Build [build_sha]) [Computer software]. https://fatcousin.com/tools/okta-log-analyzer
bluebook · online source
FatCousin Labs Inc., okta log analyzer, https://fatcousin.com/tools/okta-log-analyzer (last visited May 28, 2026).
plain english · session export
FatCousin Labs Inc., fatcousin forensics investigation session "[session_name]" (session id: [session_id]), created 2026-05-28 14:00:00 UTC, exported as [case_name].fc-case from https://fatcousin.com/forensics/sessions. Archive contains custody log, tool run manifests, optional Ed25519 signatures, and SHA-256 sidecar manifest.sha256. All processing occurred locally; files never left the examiner's device.
apa 7 · session data set
FatCousin Labs Inc.. (2026). Investigation session export (.fc-case archive) [Data set]. https://fatcousin.com/forensics/sessions. Session ID: [session_id].
bluebook · session export
FatCousin Labs Inc., FatCousin Forensics Session Export (.fc-case), https://fatcousin.com/forensics/sessions (documenting session [session_id]; last visited May 28, 2026).
plain english · .fc-case archive
Investigation archive in .fc-case format (ZIP container), exported from fatcousin forensics session manager, filename [case_name].fc-case, session id [session_id]. Contains manifest.json, manifest.sha256, custody log, optional Ed25519 signatures, structured findings[] on each run (when captured), and per-run reproducibility receipts with tool slug, semver, build SHA ([build_sha]), and SHA-256 digests. Local-only capture; verify integrity on import before relying on contents.
plain english · stix 2.1 bundle
FatCousin Labs Inc., STIX 2.1 bundle exported from fatcousin session "[session_name]" (session id: [session_id]), filename fatcousin-[session_id]-stix21.json, generated May 28, 2026 from https://fatcousin.com/forensics/sessions. Bundle includes identity, tool, file/observable SCOs, observed-data per run, and an incident SDO with CISA core incident extension. Chain-of-custody anchor: custody-log SHA-256 [custody_log_sha256] (custom property x_fatcousin_coc_hash on tool and incident objects). All processing occurred locally; verify the source .fc-case archive before citing observables.
plain english · misp event
FatCousin Labs Inc., MISP event JSON exported from fatcousin session "[session_name]" (session id: [session_id]), filename fatcousin-[session_id]-misp.json, generated May 28, 2026 from https://fatcousin.com/forensics/sessions. Event tags include fatcousin:case-type, fatcousin:coc-hash="sha256:[custody_log_sha256]", and fatcousin:tool per captured run. All attribute to_ids fields are false (triage findings, not active blocking intel). Local-only generation; attach the source .fc-case archive as provenance.
apa 7 · stix data set
FatCousin Labs Inc.. (2026). STIX 2.1 investigation bundle [Data set]. https://fatcousin.com/forensics/sessions. Session ID: [session_id]. Custody-log SHA-256: [custody_log_sha256].
apa 7 · misp data set
FatCousin Labs Inc.. (2026). MISP threat-sharing event export [Data set]. https://fatcousin.com/forensics/sessions. Session ID: [session_id]. Custody-log SHA-256: [custody_log_sha256].
templates are starting points — admissibility under FRE 901/902 or local rules is for counsel and the court, not fatcousin. see disclaimer and methodology-specific declaration blocks on each case-type guide.