drop conference bridge log · parse join + leave + dtmf entry events
flags pin brute-force hints · phantom joins · moderator privilege changes · timeline + severity/reason
heuristic screener · log format varies by platform — not definitive proof