drop synology dsm audit log export · parse access + share events
flags admin privilege escalation · shared link creation · snapshot deletion · ransomware response · off-hours · actor spikes · bulk destructive
heuristic screener · client/export format varies — column mapping is best-effort · dsm version differences · not definitive proof