drop azure key vault diagnostic export · parse key/secret operations + caller ip · runs locally
drop azure key vault diagnostic export · local only
heuristic screener · vendor schema varies · not definitive proof