drop nac admission log export · detect unauthorized endpoint joins · runs locally
drop nac admission log export · local only
heuristic screener · vendor schema varies · not definitive proof