Behavioral monitoring

Rolling statistics are computed per agent from span volume, tool mix, and timing. Alerts for deviation require sufficient history—typically multi-day windows. The UI explains warming state until thresholds are met.

We infer behavior from observable telemetry only. Sudden traffic spikes may be benign; combine baseline deviation with policy violations for higher-confidence findings.