drop trapx incident export · parse trap + attacker + stage · runs locally
drop trapx incident export · local only
heuristic screener · vendor schema varies · not definitive proof