drop salesforce setupauditTrail.csv · parse config changes + actor · flag permission profile mfa connected app changes · timeline + csv/json export · runs locally
flags permission sets · profile edits · login IP relaxations · mfa disable · connected apps · off-hours spikes
export schema varies by tenant/version — heuristic column mapping · screener · not definitive proof