// artifact family
zero-trust / sase access forensics
10 browser-only forensics tools in this catalog group — browse by artifact family when you know the kind of evidence you are working with, not the investigation pattern.
tools in this family
ordered as in the forensics catalog. every tool runs locally — no upload, no account.
- zscaler zia web log forensic analyzerdrop zscaler zia web log export · parse url category + policy + user · runs locally
- zscaler zpa app connector log forensic analyzerdrop zscaler zpa connector log · parse app segment + broker + session · runs locally
- cloudflare access audit log forensic analyzerdrop cloudflare access audit export · parse app + identity + device posture · runs locally
- palo alto prisma access log forensic analyzerdrop prisma access log export · parse gateway + app + risk score · runs locally
- cisco umbrella dns security log forensic analyzerdrop umbrella dns log export · parse category + identity + block/allow · runs locally
- netskope cloud access security log forensic analyzerdrop netskope casb log export · parse app + activity + dlp hits · runs locally
- okta device trust posture log forensic analyzerdrop okta device trust export · parse posture checks + managed vs unmanaged · runs locally
- microsoft entra conditional access log forensic analyzerdrop entra ca sign-in export · parse grant/block + policy id + risk · runs locally
- tailscale wireguard session log forensic analyzerdrop tailscale admin audit + flow log · parse node + acl + exit node use · runs locally
- zero trust access anomaly correlatordrop 2+ sase/zero-trust exports · correlate user + app + geo mismatch · runs locally