Install Loupe.

Open the App Store on your Mac and search for Loupe: Log Forensics, or open the listing directly. Click Get, then Install. macOS installs Loupe into /Applications and keeps it updated automatically.

Because it comes from the App Store, there's no Gatekeeper prompt and nothing to verify by hand — it's already notarized and sandboxed.

Launch Loupe. On first run it shows the two plans — $9.99/month or $99/year, each starting with a 14-day free trial. Click Start free trial and confirm with your Apple Account.

Every feature unlocks immediately — ingest, correlation, the narrator, and encrypted export. You aren't charged until the trial ends, and you can cancel any time in System Settings → Apple Account → Subscriptions.

Prefer to look around first? The welcome screen also loads a bundled sample case so you can see a real timeline before you start the trial.

Loupe ships without the network entitlement, so the macOS sandbox itself prevents it from reaching any server. Confirm it from a terminal:

# App Sandbox present, no outbound network entitlement
codesign -d --entitlements - /Applications/Loupe.app | grep -c network.client

That prints 0 — there is no network.client entitlement, so the OS blocks any network call regardless of code.

Drag any log file onto the window — syslog, nginx/Apache access logs, JSON Lines, an .eml thread, the macOS unified log, or a .pcap/.pcapng capture (parsed natively, no Wireshark required). Loupe creates a case automatically and starts ingesting.

For a guided first investigation, walk through the database outage flow — the canonical four-source case Loupe was built for.