drop okta threat insight export · parse actor + risk + event type · runs locally
drop okta threat insight export · local only
heuristic screener · vendor schema varies · not definitive proof