drop siem rule config export · detect mass suppression changes · runs locally
drop siem rule config export · local only
heuristic screener · vendor schema varies · not definitive proof