drop jumpcloud directory event export · parse auth + admin events
flags admin privilege changes · auth failure bursts · off-hours directory mutations · MFA bypass hints
heuristic screener · export schema varies by admin portal — not definitive proof