drop owncloud audit log · parse file + share events · timeline + findings + actor inventory · runs locally
flags external share links · admin group changes · encryption module events · off-hours · volume spikes · bulk destructive
heuristic screener · owncloud audit export schema varies by version · column mapping is best-effort · parses locally · not definitive proof