drop logon/activity csv · 24h fingerprint · chi-squared vs baseline · EMD · account sharing signals · runs locally
drop 4624 evtx or timestamped activity csv