drop graphql server access log · parse queries + variables + actor
flags introspection queries · batch abuse · error rate spikes · timeline + severity/reason
heuristic screener · log format varies by graphql server — not definitive proof