drop headscale event log · parse node + key events · runs locally
drop headscale event log · local only
heuristic screener · vendor schema varies · not definitive proof