drop dlp incident timeline export · detect severity jumps + repeat offender · runs locally
drop dlp incident timeline export · local only
heuristic screener · vendor schema varies · not definitive proof