// industry vertical
zero-trust / SASE access forensics
Zscaler ZIA/ZPA · Cloudflare Access · Palo Alto Prisma Access · Cisco Umbrella DNS · Netskope CASB · Okta device trust · Microsoft Entra conditional access · Tailscale WireGuard sessions · cross-vendor access anomaly correlation.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this vertical.
- zscaler zia web log forensic analyzerdrop zscaler zia web log export · parse url category + policy + user · runs locally
- cloudflare access audit log forensic analyzerdrop cloudflare access audit export · parse app + identity + device posture · runs locally
- microsoft entra conditional access log forensic analyzerdrop entra ca sign-in export · parse grant/block + policy id + risk · runs locally
- zero trust access anomaly correlatordrop 2+ sase/zero-trust exports · correlate user + app + geo mismatch · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
cross-cutting tools that surface depending on the specific investigation.
- zscaler zpa app connector log forensic analyzerdrop zscaler zpa connector log · parse app segment + broker + session · runs locally
- palo alto prisma access log forensic analyzerdrop prisma access log export · parse gateway + app + risk score · runs locally
- cisco umbrella dns security log forensic analyzerdrop umbrella dns log export · parse category + identity + block/allow · runs locally
- netskope cloud access security log forensic analyzerdrop netskope casb log export · parse app + activity + dlp hits · runs locally
- okta device trust posture log forensic analyzerdrop okta device trust export · parse posture checks + managed vs unmanaged · runs locally
- tailscale wireguard session log forensic analyzerdrop tailscale admin audit + flow log · parse node + acl + exit node use · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
want deeper zero-trust coverage?
this vertical is intentionally sparse — deep-moat coverage grows over time. tracked in the forensics rollout.