drop elasticsearch _audit log · parse api access + query body · runs locally
drop elasticsearch _audit log · local only
heuristic screener · vendor schema varies · not definitive proof