drop anomali threat export · parse indicator + source + confidence · runs locally
drop anomali threat export · local only
heuristic screener · vendor schema varies · not definitive proof