drop aws govcloud / azure government audit log · parse fedramp-related events · runs locally
govcloud audit log · local only
heuristic screener · vendor schema varies · not definitive proof