Run detectors

Optional custom corpus (auth.log / nginx access / UFW-style lines):