drop infoblox rpz/security log · parse policy + action + threat feed · runs locally
drop infoblox rpz/security log · local only
heuristic screener · vendor schema varies · not definitive proof