drop acr audit log export · parse repository + operation + caller · runs locally
drop acr audit log export · local only
heuristic screener · vendor schema varies · not definitive proof