drop firepower connection event export · parse intrusion policy + file action · runs locally
drop firepower connection event export · local only
heuristic screener · vendor schema varies · not definitive proof