drop mdc alert export · parse cloud security alerts · runs locally
cloud alerts · resource scope · local export only
heuristic screener · vendor schema varies · not definitive proof