drop salesforce event monitoring api logs · parse api login report events · flag token abuse report exports login anomalies bulk api spikes · timeline + csv/json export · runs locally
flags token abuse · report exports · login anomalies · bulk api spikes · off-hours · actor spikes
export schema varies by tenant/version — heuristic column mapping · screener · not definitive proof