drop adc access log export · detect sni/cert mismatch + expired chain · runs locally
drop adc access log export · local only
heuristic screener · vendor schema varies · not definitive proof