One config drives eighteen live views — what's enabled, what's missing, and what it costs.
How to use it: Set your config on the left, then explore any tab below. Everything updates live from the same state.
Esc
Evidence Report Preview
Multi-Host Evidence Report
Audit Policy & Log Sources
Import your real config
Select one or more at once — each is detected automatically:
• auditpol /get /category:* /r output (.csv/.txt)
• Sysmon config (.xml)
• PowerShell logging GPO export (.reg, or a Get-GPOReport XML/HTML export) Requires English-language Windows output — auditpol's column headers and subcategory names are localized, and this parser only recognizes the English ones.
🔒 Read in your browser only. Files are never uploaded or transmitted anywhere — parsing happens entirely on this device. The resulting toggle state (not the files themselves) is saved to this browser's local storage so it's still here next time; nothing leaves your device either way. See Privacy for details.
Impact of last change✕ dismiss
This config drives every tab above — events enabled by policy, framework coverage, gaps, dependencies, and cost.