drop tailscale admin event log + acl · parse node + connection events · runs locally
drop tailscale admin event log + acl · local only
heuristic screener · vendor schema varies · not definitive proof