// artifact family
authentication / identity
24 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- ad cs certificate template abuse detectordrop ad cs ca audit log · detect esc1-esc11 template abuse patterns
- ad cs shadow credentials detectordrop ad object diff + msds-keycredentiallink · detect shadow-cred attacks
- adminsdholder modification detectordrop ad replication + acl audit · detect adminsdholder tampering
- azure ad conditional access decision log forensic analyzerdrop entra id sign-in log · parse conditional access policy decisions
- azure ad fed trust modification detectordrop entra id federation config audit · detect rogue federated trust additions
- azure ad passwordless auth forensic analyzerdrop entra id auth log · parse fido2 + ms authenticator + tap usage
- dcshadow detection from dc event logdrop dc event log + replication state · detect rogue replication writes
- dcsync detection from dc event logdrop domain controller event log · detect drsuapi getncchanges replication abuse
- duo authentication log forensic analyzerdrop duo admin api auth log · parse push + bypass + denial events
- fido2 attestation statement forensic analyzerdrop fido2 attestation (packed/tpm/android-key) · parse aaguid + cert chain
- gpo sysvol modification detectordrop sysvol diff · parse gpo + gpttmpl + scripts changes
- jumpcloud event log forensic analyzerdrop jumpcloud directory event export · parse auth + admin events
- kerberos golden silver diamond sapphire ticket detectordrop event log + sysmon + zeek kerberos · detect all four ticket abuse classes
- lapsv2 password access audit analyzerdrop ad event 4662 + laps log · parse password reads
- oidc id token forensic analyzerdrop oidc id_token + userinfo · parse claims + acr + auth_time · timeline + findings export · runs locally
- okta system log forensic deep analyzerdrop okta system log json · parse authn + admin + policy events
- onelogin event log forensic analyzerdrop onelogin event log · parse user + app events
- ping identity audit log forensic analyzerdrop ping audit log · parse authn + admin events
- saml idp metadata forensic analyzerdrop saml idp metadata xml · parse signing certs + endpoints + history
- saml response forensic analyzerdrop saml response xml · parse assertions + attributes + signing · detect replay + audience mismatch · runs locally
- scim provisioning log forensic analyzerdrop idp scim provisioning log · parse user / group provisioning events
- sid history injection detectordrop ad object export · detect sidhistory abuse
- webauthn passkey audit forensic analyzerdrop webauthn registration + assertion log · parse authenticator data + counter
- yubikey usage log forensic analyzerdrop yubikey audit log (where available) · parse credential usage events