drop edr response log export · detect host isolation bypass · runs locally
drop edr response log export · local only
heuristic screener · vendor schema varies · not definitive proof