Anomalies
Behaviour that broke its own baseline — on the network and app layer, and in what the agents on each device actually did.
0 open in the last 7d0 network / app0 on-device agent0 capture0 MCP
Signals are written by the periodic endpoint sweep, which compares a one-hour window against a fourteen-day baseline. Each detector holds a minimum-baseline floor so a new tenant does not get a wall of day-one findings — an empty result is a normal outcome.