drop qnap qts audit log · parse access events
flags permission changes · myQNAPcloud exposure · mass file deletes · off-hours · actor spikes · bulk destructive
heuristic screener · client/export format varies — column mapping is best-effort · QTS version differences apply · not definitive proof