Behavioural anomalies

Learn what normal looks like per agent, and say when it is not.

A baseline per agent and endpoint, learned in the first week: how many tool calls, which destinations, which hours, how many subagents. A session that steps outside it is a threat with the baseline shown beside it.