drop nats broker log · parse subscriptions + delivery
flags subject wildcard abuse · connection storms · auth failures · timeline + severity/reason
heuristic screener · log format varies by nats server version and config — not definitive proof