drop m365 message trace export · parse delivery status + threat detections · runs locally
drop m365 message trace export · local only
heuristic screener · vendor schema varies · not definitive proof