drop f5 awaf request log export · parse violation + policy + ip · runs locally
drop f5 awaf request log export · local only
heuristic screener · vendor schema varies · not definitive proof