drop fastly access log · parse cache + waf decisions · runs locally
parses cache_status HIT/MISS/PASS · waf decisions · origin error spikes · response time spikes
heuristic screener · fastly logging field set varies by endpoint — not definitive proof