drop siem alert export · detect repetitive low-value alert storms · runs locally
drop siem alert export · local only
heuristic screener · vendor schema varies · not definitive proof