ZeroAuthority SIFT
Technical dataset analysis and correlation
Drop in a CSV, JSON, log or indicator list and see what is in it, what repeats and what connects. SIFT runs entirely in your browser: the dataset is never uploaded.
Format detection
CSV, TSV, JSON, JSON Lines and plain log or text input are recognized automatically.
Indicator extraction
IP addresses, domains, URLs, emails, hashes and CVE IDs, including defanged forms such as hxxp and [.].
Field profiling
Types, uniqueness, most common values and numeric outliers for every field.
Correlation and pivots
See which indicators appear together, and pivot from any indicator to every record it is in.
Timeline and bursts
When timestamps are present, activity is bucketed and unusual bursts are flagged.
Hand-off to FORGE
Send extracted indicators into an enrichment workflow, only when you choose to.
SIFT is part of SYSTEMS, which comes with the Reserve plan. Create a free account first, then request Reserve to use SIFT.