drop pagerduty incident export · parse incident lifecycle + acks + responders · timeline + findings + actor inventory · runs locally
flags escalation policy edits · user role grants · mass resolve · after-hours ack gaps · off-hours · volume spikes · bulk destructive
heuristic screener · export schema varies by tenant/version · column mapping is best-effort · parses artifacts locally · not definitive proof