drop layer7 audit export · parse policy + service + user · runs locally
drop layer7 audit export · local only
heuristic screener · vendor schema varies · not definitive proof