drop microsoft intune event log · parse device + compliance + app deploy events · runs locally
drop microsoft intune event log · local only
heuristic screener · vendor schema varies · not definitive proof