Evidence compatibility
Support means CaseScope recognizes and processes the listed format under the stated conditions. It does not imply acquisition support or completeness beyond the supplied evidence. Ingest, parse, normalize, and certified workflow are not equivalent.
Supported implemented and covered by routine tests
Compatible expected format, not certified
Best effort generic mapping
Planned not available
Certified fixture certificates are not a published customer program yet. Last verified: September 2026 against production source 4.26.13. Status should be treated as website guidance until it is generated from the same acceptance evidence the application uses.
| Family | Accepted input | Method | Status | Output | Limitation |
|---|---|---|---|---|---|
| Windows events | EVTX | EvtxECmd, Hayabusa | Supported | Events hunt | Rule coverage follows Hayabusa, not every Windows event. |
| Windows host artifacts | Prefetch, registry, LNK, Jump Lists, MFT, SRUM, tasks, Timeline | Parser catalog | Supported | Hunt tabs | Collection completeness is the customer’s. |
| Browsers | SQLite, Firefox session/JSON, WebCache | Browser parsers | Supported | Browsers hunt | Profile and version variants differ. |
| Generic logs | IIS, JSON, CSV | Generic parsers | Best effort | Events | Schema-dependent. |
| Firewall / IDS | SonicWall, Palo Alto, FortiGate, pfSense, Cisco, Suricata, generic | Vendor-oriented parsers | Compatible | Events / network | Export dialect is not certified. |
| EDR / DFIR exports | Huntress, Defender, CrowdStrike, SentinelOne, Sophos, Velociraptor, Plaso | Export parsers | Compatible | Events | Recognizing an export is not vendor certification. |
| Triage packages | KAPE, CyLR-style, RMM logs | Collection parsers | Supported / Compatible | Contained artifacts | RMM versions vary. |
| Linux / macOS | syslog, journal, SSH, plists, FSEvents, ASL | Unix parsers | Compatible | Linux / macOS hunts | Not a full Mac forensic suite. |
| Memory | Memory images | Volatility3 | Supported | Memory lane | Plugin and profile selection matter. |
| PCAP | PCAP, PCAPNG | Zeek-oriented | Supported | Network hunt | Not a full NSM console. |
| Retained files | Screenshots, exports | Evidence vault | Supported | Evidence page | Not parsed as events. |
| Cloud / SaaS exports | M365, Entra, CloudTrail, Workspace | Offline import | Planned | — | Not available now. |