drop zendesk audit log api export · parse ticket + agent activity
flags agent role grants · macro edits · ticket mass updates · oauth app installs · off-hours · volume spikes · bulk destructive
heuristic screener · export schema varies by tenant/version — column mapping is best-effort · not definitive proof