01 / Research workflows
Open the task that matches the material in front of you. Files, URLs, mail headers, logs, and checksums are examined here before any separate network lookup is considered.
FilesThe file page reads bytes selected from this device and does not execute them.
URLs and mailParsers inspect text and structure without opening the destination or performing DNS lookups.
ExportsDownloaded summaries keep findings and counts while omitting raw sensitive material.
Organize a single local file first, then decide whether a separate authorized flow is needed.
Inspect URL structure, IDN/Punycode, Safe Links, and defang/refang without visiting the target.
Parse headers or .eml text locally before moving links or observables into other tasks.
Extract observables from logs, alerts, and reports for clean handoff and review.
Normalize hashes and compare checksums locally before sharing an investigation target.
Browser workParsing, hashing, normalization, and report assembly happen in the current page.
Application logsPasted values and selected file bytes are not sent to the application backend.
Separate lookupsA future network lookup must be a distinct, explicit action that names its destination and submitted fields.