drop jenkins master system log · parse plugin + auth events · runs locally
flags failed login bursts · plugin downgrades · security realm changes · agent connection anomalies
heuristic screener · jenkins log format varies by version and plugins — not definitive proof · best-effort timestamp and logger parsing