drop freshdesk audit log · parse agent + ticket events
flags role changes · ticket deletes · automation edits · IP anomalies · off-hours · volume spikes · bulk destructive
heuristic screener · export schema varies by tenant/version — column mapping is best-effort · not definitive proof