drop vm console access log · parse user + vm + session duration · runs locally
drop vm console access log · local only
heuristic screener · vendor schema varies · not definitive proof