drop bitdefender gravityzone event csv · runs locally
endpoint events · threat actions · local export only
heuristic screener · vendor schema varies · not definitive proof