A parks IT team needs scripted forensic analysis to timeline auth anomalies across multiple branch sites. Which approach best fits that multi-site civic need?

A parks IT team that needs scripted forensic analysis to timeline auth anomalies across multiple branch sites should use notebook-style scripted forensic analysis to timeline auth anomalies across those sites. Notebooks and scripts make multi-site correlation repeatable: the same joins, time windows, and anomaly features run against each branch's auth logs and produce a comparable timeline instead of one-off manual charts. Civic parks estates are geographically scattered; automation stitches branch evidence into a single investigative narrative the central team can act on. Why the other options fail by concept: Use notebook-style scripted forensic collection to timeline auth anomalies across branch sites uses the right sites and auth data but the wrong forensic function — it only gathers and preserves auth logs, so it does not run the analytic correlation and anomaly timelines the investigation needs. Use notebook-style scripted compliance reporting to timeline auth anomalies across branch sites covers multiple sites with scripts but serves compliance, not forensics; it produces standardized audit reports and does not reconstruct investigative anomaly timelines. Use notebook-style scripted forensic analysis to timeline auth alerts across branch sites uses the right scripted multi-site method but on the wrong object — it only orders already-fired alerts, not underlying auth anomalies from raw logs, so anomalous patterns that never triggered an alert stay invisible. Exam caveat: scripted notebooks still need validated time sync (NTP) and consistent log schemas across branches, or timelines will mis-order events. Operational check: run the auth-anomaly notebook against at least two branch sites plus HQ for a known test window, verify cross-site account correlation, and store the output under the municipal case ID before analyst conclusions are filed.