drop cloudflare dns firewall log · parse matched rule + query type · runs locally
drop cloudflare dns firewall log · local only
heuristic screener · vendor schema varies · not definitive proof