# Canvas Forensic Engine

*/Agents/Canvas_Forensic_Engine*

## Solution Overview

The Canvas Forensic Engine connects directly to an institution's Canvas LMS environment to monitor and audit student interaction logs during high-stakes exams. It continuously parses page views, IP address changes, browser focus events, and typing cadences to isolate anomalies. The engine generates an evidence-backed incident report for every flagged submission, compiling timestamped log data into a timeline that visualizes the exact sequence of unauthorized actions.

University academic integrity officers and departmental discipline committees deploy this agent to bypass the manual extraction of raw Canvas access logs. Instead of downloading CSVs and cross-referencing IP subnets across hundreds of student accounts to prove collusion, the investigator assigns a course ID to the agent via Slack. The agent returns a compiled dossier detailing the technical footprint of the violation, removing the need for faculty to interpret raw server data.

Operating as a digital investigator, the agent consumes raw event streams from the Canvas Data API and integrates with identity verification webhooks. It structures these inputs into formal reports and routes them into academic ticketing systems like Maxient. Because academic disciplinary actions carry severe consequences for student enrollment, the agent makes no punitive decisions; a human review board validates every forensic dossier before issuing any penalties.

## Icp Opportunities

- [Automated Forensic Triage](/Opportunities/Automated_Forensic_Triage) — Agent
- [Incident Timeline Engine](/Opportunities/Incident_Timeline_Engine) — Headless SaaS
- [Forensics as a Service](/Opportunities/Forensics_as_a_Service) — Service-as-Software
- [Evidence Custody API](/Opportunities/Evidence_Custody_API) — Headless SaaS
- [Automated SLA Defense](/Opportunities/Automated_SLA_Defense) — Agent

## Agent Definition

**Goals**:
- [Investigation Cycle Time](/Metrics/Investigation_Cycle_Time)
- [Anomaly Detection Accuracy](/Metrics/Anomaly_Detection_Accuracy)
- [Report Generation Speed](/Metrics/Report_Generation_Speed)
**Tools**:
- [Canvas LMS](/Products/Canvas_LMS)
- [Maxient](/Products/Maxient)
**Skills**:
- [Digital Forensics](/Skills/Digital_Forensics)
- [Pattern Analysis](/Skills/Pattern_Analysis)
- [Data Correlation](/Skills/Data_Correlation)
- [Technical Writing](/Skills/Technical_Writing)
- [Log Analysis](/Skills/Log_Analysis)
**Contacts**:
- Slack
- Webhook
- API
**Identity**: did:web:agents.institution.example/canvas-forensic-engine
**Core Tasks**:
- [Parse Canvas Page Views](/Tasks/Parse_Canvas_Page_Views)
- [Cross-Reference IP Subnets](/Tasks/Cross-Reference_IP_Subnets)
- [Track Browser Focus Events](/Tasks/Track_Browser_Focus_Events)
- [Compile Timestamped Timelines](/Tasks/Compile_Timestamped_Timelines)
- [Route Dossiers to Maxient](/Tasks/Route_Dossiers_to_Maxient)
**Escalation**: Generates forensic dossiers autonomously but escalates every flagged submission to a human academic discipline committee for validation before any punitive action is taken.
**Memory Kind**: persistent
**Memory Note**: Retains historical IP subnet mappings and cross-student session patterns to rapidly identify recurring collusion networks across different courses.
**Autonomy Mode**: guarded
**Replaces Role**: [Digital Forensic Investigator](/JobTypes/Digital_Forensic_Investigator)
**Solves Problem**: [Manual Log Interpretation](/Problems/Manual_Log_Interpretation)
**Responsibilities**:
- Audit High-Stakes Exam Logs
- Isolate Access Anomalies
- Draft Evidence-Backed Reports
- Map Collusion Networks

## Agent Function Cascade

**Ai Role**: The AI operates a guarded loop that autonomously ingests Canvas logs, correlates IP and session anomalies, and drafts evidence-backed forensic dossiers, pausing execution for a mandatory review by the academic discipline committee before routing finalized cases to Maxient.
**Cascade**:
- Kind: Code · Note: Retrieves page views and browser focus events via Canvas API. · Step: Ingest Exam Logs · Verb: ingest · Realizes: Collect System Event Logs · Oversight: none
- Kind: Code · Note: Maps IP subnets and cross-student session timestamps. · Step: Correlate Session Data · Verb: correlate · Realizes: Cross-Reference Access Logs · Oversight: none
- Kind: Generative · Note: Identifies historical subnet overlaps and recurring collusion patterns. · Step: Map Collusion Networks · Verb: analyze · Realizes: Analyze Session Anomalies · Oversight: none
- Kind: Generative · Note: Generates a timeline-backed report of isolated access anomalies. · Step: Compile Forensic Dossier · Verb: draft · Realizes: Draft Investigation Report · Oversight: none
- Kind: Human · Note: A human committee reviews every flagged submission before punitive action. · Step: Discipline Committee Validation · Verb: approve · Realizes: Validate Forensic Evidence · Oversight: approves
- Kind: Code · Note: Pushes the approved dossier into the academic integrity system. · Step: Dispatch Case To Maxient · Verb: dispatch · Realizes: Route Disciplinary Dossiers · Oversight: none
**Optimizes**:
- [Investigation Cycle Time](/Metrics/Investigation_Cycle_Time)
- [Anomaly Detection Accuracy](/Metrics/Anomaly_Detection_Accuracy)
- [Report Generation Speed](/Metrics/Report_Generation_Speed)
- [False Positive Rate](/Metrics/False_Positive_Rate)

## Agent Representative Offer

**Warranty**: Provides a 99.9% uptime SLA for log ingestion endpoints and guarantees unaltered provenance tracking for all extracted Canvas log data.
**Price Band**: Roughly $0.50 to $2.50 per exam session analyzed, depending on log density and total monthly volume.
**Pricing Kind**: UsageMeter
**Deliverables**:
- Timestamped session timelines for browser focus events
- IP subnet correlation maps identifying cross-student collusion networks
- Drafted evidentiary dossiers formatted for academic discipline committees
- Flagged access anomaly alerts delivered via Slack
**Delivery Mode**: The buyer provisions the agent directly via secure API tokens for Canvas and Maxient, with log ingestion and analysis available immediately upon webhook activation.
**Business Function**: ProvideService
**Agent Checkout Support**:
- agentic-commerce-protocol
- stored-credential

## Agent Composes Headless Saas

- [LMS Audit Log API](/Software/LMS_Audit_Log_API) — Data Extraction
- [Subnet Mapping API](/Software/Subnet_Mapping_API) — Network Intelligence
- [Collusion Detection Model](/Software/Collusion_Detection_Model) — Graph Analysis
- [Dossier Generation Engine](/Software/Dossier_Generation_Engine) — Document Gen
- [Case Management API](/Software/Case_Management_API) — Routing

## Agent Sequence Diagram

```mermaid
sequenceDiagram
participant W as Webhook
participant CFE as Canvas Forensic Engine
participant LMS as LMS Audit Log API
participant SMA as Subnet Mapping API
participant CDM as Collusion Detection Model
participant DGE as Dossier Generation Engine
participant ADC as Human: Academic Discipline Committee
participant CMA as Case Management API

W->>CFE: Trigger Exam Completed
CFE->>LMS: Fetch Canvas Page Views and Focus Events
LMS-->>CFE: Return raw timestamped logs
CFE->>SMA: Cross-reference IP Subnets
SMA-->>CFE: Return historical subnet mappings
CFE->>CDM: Analyze access anomalies and map networks
CDM-->>CFE: Return collusion probability and matched patterns
CFE->>DGE: Compile evidence-backed timeline
DGE-->>CFE: Return drafted forensic dossier

opt Flagged submission requiring validation
CFE->>ADC: Escalate dossier for validation
ADC-->>CFE: Approve punitive action
end

CFE->>CMA: Route dossier to Maxient
CMA-->>CFE: Case created successfully
```

## Neighborhood

### What it uses

- [Canvas Learning Management](/Products/Canvas_Learning_Management) — uses · Products
- [Maxient](/Products/Maxient) — uses · Products

### Optimizes

- [Anomaly Detection Accuracy](/Metrics/Anomaly_Detection_Accuracy) — optimizes · Metrics
- [Report Generation Speed](/Metrics/Report_Generation_Speed) — optimizes · Metrics
- [Investigation Cycle Time](/Metrics/Investigation_Cycle_Time) — optimizes · Metrics
- [False Positive Rate](/Metrics/False_Positive_Rate) — optimizes · Metrics

### What it addresses

- [Manual Log Interpretation](/Problems/Manual_Log_Interpretation) — addresses · Problems

### What it does

- [Compile Timestamped Timelines](/Tasks/Compile_Timestamped_Timelines) — performs · Tasks
- [Cross-Reference IP Subnets](/Tasks/Cross-Reference_IP_Subnets) — performs · Tasks
- [Parse Canvas Page Views](/Tasks/Parse_Canvas_Page_Views) — performs · Tasks
- [Route Dossiers to Maxient](/Tasks/Route_Dossiers_to_Maxient) — performs · Tasks
- [Track Browser Focus Events](/Tasks/Track_Browser_Focus_Events) — performs · Tasks

### Replaces this role

- [Digital Forensic Investigator](/JobTypes/Digital_Forensic_Investigator) — replaces · JobTypes

### Required skills

- [Data Correlation](/Skills/Data_Correlation) — requires skill · Skills
- [Digital Forensics](/Skills/Digital_Forensics) — requires skill · Skills
- [Log Analysis](/Skills/Log_Analysis) — requires skill · Skills
- [Pattern Analysis](/Skills/Pattern_Analysis) — requires skill · Skills
- [Technical Writing](/Skills/Technical_Writing) — requires skill · Skills

### Latent gaps

- [Incident Timeline Engine](/Opportunities/Incident_Timeline_Engine) — latent gap · Opportunities
- [Forensics as a Service](/Opportunities/Forensics_as_a_Service) — latent gap · Opportunities
- [Evidence Custody API](/Opportunities/Evidence_Custody_API) — latent gap · Opportunities
- [Automated SLA Defense](/Opportunities/Automated_SLA_Defense) — latent gap · Opportunities
- [Automated Forensic Triage](/Opportunities/Automated_Forensic_Triage) — latent gap · Opportunities

### Composed of

- [Subnet Mapping API](/Software/Subnet_Mapping_API) — composes · Software
- [LMS Audit Log API](/Software/LMS_Audit_Log_API) — composes · Software
- [Dossier Generation Engine](/Software/Dossier_Generation_Engine) — composes · Software
- [Collusion Detection Model](/Software/Collusion_Detection_Model) — composes · Software
- [Case Management API](/Software/Case_Management_API) — composes · Software

### Problems this exposes

- [SLA Breach Penalties](/Problems/SLA_Breach_Penalties) — exposes problem · Problems
- [Specialized Investigator Shortage](/Problems/Specialized_Investigator_Shortage) — exposes problem · Problems
- [Incident Timeline Reconstruction](/Problems/Incident_Timeline_Reconstruction) — exposes problem · Problems
- [Forensic Data Storage Costs](/Problems/Forensic_Data_Storage_Costs) — exposes problem · Problems
- [Cross-Platform Log Correlation](/Problems/Cross-Platform_Log_Correlation) — exposes problem · Problems
- [Chain of Custody Preservation](/Problems/Chain_of_Custody_Preservation) — exposes problem · Problems
- [Automated Threat Evasion](/Problems/Automated_Threat_Evasion) — exposes problem · Problems

### Similar Startups

- [Turnintegrity](/Startups/Turnintegrity) — similar · Startups
- [Chairera](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Chairera) — similar · Startups
- [Evaluateroot](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Evaluateroot) — similar · Startups
- [Evidenceloom](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Evidenceloom) — similar · Startups
- [Outciver](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Outciver) — similar · Startups
- [Facata](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Facata) — similar · Startups
- [Astralheart](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Astralheart) — similar · Startups
- [Syntaxfusion](/Problems/Cross-System_Evidence_Extraction/Startups/Syntaxfusion) — similar · Startups
- [Dynanim](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Dynanim) — similar · Startups
- [Forgadge](/Startups/Forgadge) — similar · Startups
- [Gradebookgarden](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Gradebookgarden) — similar · Startups
- [Abetcode](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Abetcode) — similar · Startups
- [Academiclane](/Industries/Educational_Services/Problems/Instructional_Delivery_And_Scaling/Startups/Academiclane) — similar · Startups
- [Forensichub](/Startups/Forensichub) — similar · Startups
- [Rigore](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Rigore) — similar · Startups
- [Domill](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Domill) — similar · Startups
- [Cumbonata](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Cumbonata) — similar · Startups
- [Facollow](/Occupations/Engineering_and_Architecture_Teachers,_Postsecondary/Problems/ABET_Accreditation_Data_Collection/Startups/Facollow) — similar · Startups

### Similar Agents

- [Score Record Agent](/Agents/Score_Record_Agent) — similar · Agents
- [Artifact Correlation Agent](/Agents/Artifact_Correlation_Agent) — similar · Agents