drop dot1x auth log export · detect burst authentication failures · runs locally
drop dot1x auth log export · local only
heuristic screener · vendor schema varies · not definitive proof