Interesting signal, needs a sceptical operator

The anomaly detection surfaces things a signature approach misses, and on an OT-adjacent network that was the point. It also surfaces a great deal that is simply unusual rather than malicious, so it rewards an operator who will tune it and punishes one who will not. The autonomous response feature we left in advisory mode after testing.