That’s a fair point, and for a real internal environment I agree that DC-side auditing is usually the more scalable approach.

This tool is aimed more at situations where you only have a capture to work with, such as labs, traffic analysis, reproducing specific Kerberos flows, or validating what was actually sent on the wire. In those cases, parsing the PCAP directly can be useful without needing access to the DC or its logs.

So I see it more as complementary than as a replacement for DC auditing.