drop idp scim provisioning log · parse user / group provisioning events
flags mass user provisioning · privileged group SCIM changes · failed→success retries · off-hours bulk deletes
heuristic screener · vendor log schema varies — field mapping is indicative only · not definitive proof