drop mosquitto / emqx / hivemq broker log · parse client + topic activity
flags auth failures · ACL denials · topic enumeration bursts · timeline + severity/reason
heuristic screener · log format varies by broker — not definitive proof