drop i-sight export · parse investigation + witness + user · runs locally
drop i-sight export · local only
heuristic screener · vendor schema varies · not definitive proof