drop ground station gateway access log · parse terminal auth + quota + ip sessions · runs locally
drop ground station gateway access log · local only
heuristic screener · vendor schema varies · not definitive proof