ZeroAuthority SIFT

Exports, logs and indicator lists are easy to collect and hard to read. SIFT analyzes a dataset you provide, entirely in your browser: it detects the format, pulls out indicators, profiles each field, finds outliers and bursts, and shows which values appear together.

Data source

The log, export or indicator list you load. All analysis runs in your browser

Sent externally

No. Stays in your browser.

• CSV, TSV, JSON, JSON Lines, HAR exports, web access logs, DNS query logs and plain text
• Indicator extraction: IP addresses, domains, URLs, emails, hashes and CVE IDs, including defanged forms
• Findings with the method behind each one, a confidence level and the source record numbers
• Frequency, HTTP status, hour-of-day and weekday distributions, with a clickable timeline and burst detection
• Up to six datasets compared at once: values shared across files are exact matches, other links are labelled inferred
• A relationship graph, record search with field:value and exclusions, and a sealed PDF report with client-reported file SHA-256 hashes

1. 1Paste or open datasets→
2. 2Detect format and fields→
3. 3Review findings and the timeline→
4. 4Correlate across files→
5. 5Export a sealed PDF or send indicators to FORGE

• Runs in your browser
• Evidence locker
• Sealed PDF reports
• FORGE (indicator hand-off)

• All of SIFT on Reserve

• ZeroAuthority FORGE
• ZeroAuthority VIGIL
• ZeroAuthority WATCH