drop iec 62351 security event log · parse cert + role-based-access events · runs locally
drop iec 62351 security event log · local only
heuristic screener · vendor schema varies · not definitive proof