// industry vertical
identity governance / IGA forensics
SailPoint · Saviynt · Okta lifecycle · Entra governance · Ping · OneLogin · role mining · orphaned accounts · SoD violations · cross-IGA lifecycle correlation.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this vertical.
- sailpoint identityiq certification export forensic analyzerdrop sailpoint certification campaign export · parse reviewer + entitlement + decision · runs locally
- saviynt access governance audit forensic analyzerdrop saviynt audit log export · parse role + sod + remediation task · runs locally
- segregation of duties violation forensic analyzerdrop sod policy export · parse conflicting entitlements + owners · runs locally
- cross iga account lifecycle correlatordrop 2+ iga exports · correlate account lifecycle across systems · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
cross-cutting tools that surface depending on the specific investigation.
- okta lifecycle provisioning log forensic analyzerdrop okta lifecycle provisioning export · parse app assignment + deprovision + group push · runs locally
- microsoft entra governance access review forensic analyzerdrop entra access review export · parse reviewer + resource + decision timeline · runs locally
- ping identity access management audit forensic analyzerdrop ping audit log export · parse adapter + mapping + sync result · runs locally
- onelogin user provisioning event forensic analyzerdrop onelogin provisioning event export · parse app + role + mapping action · runs locally
- iga role mining anomaly detectordrop iga entitlement export · detect over-provisioned role clusters · runs locally
- orphaned account detector from iga exportdrop iga account inventory export · detect stale/orphan accounts · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
want deeper IGA coverage?
this vertical is intentionally sparse — deep-moat coverage grows over time. tracked in the forensics rollout.