drop cloudtrail iam event export · parse user/role + action bursts + deny patterns · runs locally
drop cloudtrail iam event export · local only
heuristic screener · vendor schema varies · not definitive proof