drop consul audit log · parse kv + service events
flags acl token create · kv prefix mass delete · connect intentions · timeline + actor rollup
heuristic screener · consul audit format varies by version and sink — not definitive proof