drop agent network log · detect data exfiltration via agent · runs locally
agent network log · egress csv · local only
heuristic screener · vendor schema varies · not definitive proof