drop amplitude event export json or csv · parse user events and properties · flag account takeover signals property tampering bulk delete exports and geo anomalies · runs locally
flags account takeover · property tampering · bulk exports · geo anomalies · off-hours activity · actor volume spikes
export schema varies by tenant and amplitude version — heuristic column mapping · screener only · not definitive proof