drop waf + cdn access exports · correlate blocked ip + cache hit · runs locally
drop waf + cdn access exports · local only
heuristic screener · vendor schema varies · not definitive proof