Benign / Normal Behavior Collection

Objective

Collect a clean, provenance-preserving baseline of normal behavior from each confirmed experimental entity.

Why this matters

The edge model learns each host's normal behavior from this corpus; baseline quality therefore directly constrains anomaly-detection validity.

Design considerations

• Set the final benign collection window only after telemetry validation provides measured event volume, loss behavior, and storage requirements.
• Maintain collection manifests, source-contract checks, zero-loss gates, and contamination controls throughout the baseline window.
• Keep the window and dataset-freeze criteria explicit and reproducible for each confirmed entity.

Key decisions

• Benign collection-window ADR — pending telemetry validation.
• Dataset-freeze criteria ADR — pending telemetry validation.