// industry vertical
NGFW / firewall platform forensics
Palo Alto · FortiGate · Check Point · Firepower · Juniper SRX · Sophos XG · WatchGuard · pfSense · OPNsense · multi-NGFW traffic correlation across firewall log exports.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this vertical.
- palo alto traffic log forensic analyzerdrop palo alto traffic log export · parse app-id + rule + session end reason · runs locally
- fortinet fortigate traffic log forensic analyzerdrop fortigate traffic log export · parse policy id + utm refs + action · runs locally
- checkpoint firewall log forensic analyzerdrop checkpoint log export · parse blade + rule + nat hints · runs locally
- multi ngfw traffic correlatordrop 2+ ngfw traffic exports · correlate src/dst + app overlap · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
cross-cutting tools that surface depending on the specific investigation.
- cisco firepower connection log forensic analyzerdrop firepower connection event export · parse intrusion policy + file action · runs locally
- juniper srx flow log forensic analyzerdrop srx flow session log export · parse zone + policy + service · runs locally
- sophos firewall traffic log forensic analyzerdrop sophos xg traffic log export · parse fw rule + app control + web filter · runs locally
- watchguard firebox traffic log forensic analyzerdrop watchguard traffic log export · parse policy + geolocation + ips hit · runs locally
- pfsense filterlog forensic analyzerdrop pfsense filterlog export · parse rule number + interface + action · runs locally
- opnsense firewall log forensic analyzerdrop opnsense firewall log export · parse alias + gateway + block/pass · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
want deeper NGFW coverage?
this vertical is intentionally sparse — deep-moat coverage grows over time. tracked in the forensics rollout.