drop box admin audit log · parse user + content + sharing events · timeline + findings + actor inventory · runs locally
flags co-admin grants · external collaborators · retention changes · mass deletes · off-hours · volume spikes · bulk destructive
heuristic screener · box admin export schema varies by tenant/version · column mapping is best-effort · parses locally · not definitive proof