drop vault audit json · parse secret access + lease events · timeline + findings · runs locally
flags root token usage · policy changes · mass secret reads · seal/unseal · lease events · sys config changes
heuristic screener · vault audit format varies by version and mount type · parses artifacts locally · not definitive proof