diff --git a/README.md b/README.md
index 7e0a6e0..2e52f57 100644
--- a/README.md
+++ b/README.md
@@ -190,7 +190,29 @@ model such as `qwen3:8b` or `qwen3:14b`. Enable `Ollama profile advisor` and set
 `Profile advisor model` in Settings. Advisor output must be valid JSON and is
 validated against fields actually seen in the stream before it can be applied.
 Unknown fields, raw message fields, internal `fgai_*` fields, and unknown
-detectors are rejected.
+detectors are rejected. The advisor is only called for fields the deterministic
+pass is genuinely unsure about (see below), not the whole profile every poll, and
+is throttled by `Profile advisor interval seconds` so it does not run more often
+than necessary on a memory-constrained local GPU.
+
+Field discovery does not rely only on field names. Every observed field is also
+classified from its sample values into a shape (IP address, timestamp, port,
+numeric, low-cardinality categorical, or free text) with a 0-100 confidence
+score. A field name match is still used, but only as a small, capped nudge on
+top of that shape evidence, so a vendor-specific field name SignalScope has
+never seen before can still be recognized as an entity, categorical, or numeric
+field from its values alone. Two IP-shaped fields with ambiguous names are
+told apart by which one leans more private (source-like) versus more public
+(destination-like). Detectors can also be suggested from observed value
+patterns, for example a low-cardinality field containing values such as
+`denied` or `blocked` suggesting the deny-action detector, independent of
+what the field or stream happens to be named. `Field confidence threshold` in
+Settings controls both how confident a field must be before it counts as
+unambiguous (for advisor scoping) and, when auto-apply is enabled, before its
+stream profile is applied automatically. Each recommended profile in the
+dashboard status payload carries the underlying per-field shape and confidence
+values, so a `field_confidence`/`field_shapes` map is available for any field
+even when it was not selected into the applied profile.
 
 Windows-like streams are recognized from stream names such as `Windows`,
 `Winlog`, `Security Event Log`, `Sysmon`, and `Powershell`, or from Windows event
@@ -246,6 +268,22 @@ categorical, numeric, and detector fields. Existing profile names, field weights
 and detector threshold settings are preserved, so this is the fast path after
 field-alias matching improves or after Graylog starts parsing additional fields.
 
+Enable `Auto-apply high-confidence stream profiles` in Settings to skip the
+`Apply`/`Update profile` click for streams where every selected field already
+clears `Field confidence threshold`. A profile is only ever auto-applied when it
+has no manually-set field: if even one field in an existing profile was set by
+hand, that whole stream is left alone by auto-apply and stays on the normal
+review flow. Fields written by auto-apply are marked internally so a later
+manual edit through the Profile editor is never silently overwritten by a
+future auto-apply cycle. If an auto-applied field's classification drifts
+later, for example because a vendor changed their log format, SignalScope does
+not silently re-apply a new mapping; it only records the drift in the status
+payload (`profile_drift`) for now, with no dashboard panel yet, so the live
+profile stays exactly as it was applied until someone reviews it. The auto-apply
+and advisor-scoping thresholds share the same `Field confidence threshold`
+setting, and drift-history retention is controlled separately by `Field
+confidence history retention days`.
+
 Profile discovery is accumulated over monitor cycles. This matters in high-EPS
 environments where each poll only fetches a raw sample for context while
 aggregate queries count the full window. Fields seen in earlier samples are kept
diff --git a/src/fgai/dashboard.py b/src/fgai/dashboard.py
index 9e96fa7..8723c5a 100644
--- a/src/fgai/dashboard.py
+++ b/src/fgai/dashboard.py
@@ -187,7 +187,7 @@ HTML = """<!doctype html>
     <div data-view="overview" class="active"><section class="split"><div class="panel"><h2>Events and Anomalies</h2><canvas id="trendChart" class="chart"></canvas></div><div class="panel"><h2>Baseline and Stream Health</h2><div id="health"></div></div></section><section class="panel"><h2>Operator Guidance</h2><div id="actionPlan" class="muted">Waiting for monitor data.</div></section><section class="panel"><h2>Correlation Map</h2><div class="correlation-layout"><div><canvas id="correlationGraph" class="graph"></canvas><div id="correlationGraphInfo" class="muted"></div></div><div id="correlationExplorer" class="muted">Waiting for correlated entities.</div></div></section><section class="panel"><h2>Investigation Incidents</h2><div class="toolbar"><label><input id="showResolvedIncidents" type="checkbox"> show resolved</label><button type="button" id="clearResolvedIncidents">Clear resolved</button><button type="button" id="clearAllIncidents">Clear all</button><span id="incidentSummary"></span></div><div id="incidentNotice" class="muted" role="status"></div><div id="incidents"></div></section><section class="split"><div class="panel"><h2>Anomalies</h2><div id="anomalies"></div></div><div class="panel"><h2>Recommendations</h2><div id="recommendations"></div></div></section><section class="panel"><h2>AI Assessment</h2><div id="llmAssessment" class="muted">LLM assessment disabled.</div></section></div>
     <div data-view="findings"><section class="panel"><h2>Triage Queue</h2><div id="triageQueue"></div></section><section class="panel"><h2>Field Baseline Deviations</h2><div class="toolbar"><label><input id="showReviewedFindings" type="checkbox"> show reviewed</label><label><input id="showLowFindings" type="checkbox"> show low score</label><span id="findingSummary"></span></div><div id="feedbackNotice" class="muted" role="status"></div><div id="fieldDeviations"></div><div id="reviewForm" hidden><div class="toolbar"><label>Scope<br><select id="reviewScope"><option value="value">Exact value</option><option value="field">This field</option><option value="entity">Entire entity</option><option value="stream">Whole stream</option></select></label><label>Note<br><input id="reviewNote" type="text"></label><label>Expiry (days, 0 = never)<br><input id="reviewExpiryDays" type="number" min="0" step="1" value="0"></label><label>Author<br><input id="reviewAuthor" type="text"></label></div><div id="reviewScopeWarning" class="muted" role="status" hidden>Broad-scope rules must expire. Choose how many days this suppression should last.</div><p><button type="button" id="reviewSubmit">Save review</button> <button type="button" id="reviewCancel">Cancel</button></p></div></section><section class="panel"><h2>Active Feedback Rules</h2><div class="toolbar"><span id="feedbackRuleSummary"></span></div><div id="feedbackRules"></div></section><section class="panel"><h2>Related Activity Across Sources</h2><div id="relatedActivity"></div></section><section class="split"><div class="panel"><h2>Block Candidates</h2><div id="blocks"></div></div><div class="panel"><h2>Threat Intelligence</h2><div id="reputation"></div></div></section><section class="panel"><h2>Policy Findings</h2><div id="policies"></div></section></div>
     <div data-view="diagnostics"><section class="panel"><h2>Diagnostics</h2><div id="diagnostics"></div></section></div>
-    <div data-view="settings"><section class="panel"><h2>Recommended Stream Profiles</h2><div class="toolbar"><label><input id="showExistingProfiles" type="checkbox"> show existing profiles</label><span id="profileSuggestionSummary"></span></div><div id="profileApplyResult" class="muted" role="status"></div><div id="profileSuggestions" class="muted">Waiting for observed stream data.</div></section><section class="panel"><h2>Installed Ollama Models</h2><div id="ollamaModels" class="muted">Loading local Ollama models.</div></section><section class="panel"><h2>Runtime Configuration</h2><form id="settingsForm"><div class="grid"><label>Log source<br><select name="log_source"><option value="local_syslog">Local syslog</option><option value="graylog_mcp">Graylog MCP</option></select></label><label>Graylog MCP URL<br><input name="graylog_mcp_url" type="url" placeholder="https://graylog.example/api/mcp"></label><label>Enabled streams<br><button type="button" id="loadStreams">Load streams</button><div id="streamPicker" class="muted">Load streams after URL and token are saved.</div></label><label>Profile editor<br><button type="button" id="loadFields">Edit first checked stream profile</button><div id="profileEditorStatus" class="muted">No profile selected for editing.</div><div id="fieldPicker" class="muted">Click Edit profile on one stream.</div></label><label>Profile name<br><input name="profile_name" placeholder="Example: Windows login behavior"></label><label>Detector thresholds (JSON)<br><textarea name="profile_detectors" placeholder='{"auth_failure":{"enabled":true,"minimum":5,"z_threshold":3}}'></textarea></label><label>Field weights (JSON)<br><textarea name="profile_field_weights" placeholder='{"url":1.5,"auth_failure_burst":2,"query_domain":{"rare_value":1.8}}'></textarea></label><label>Behavior relationships (JSON)<br><textarea name="profile_relationship_fields" placeholder='[{"left":"username","right":"srcip","name":"user source IP"}]'></textarea></label><label>Graylog query<br><input name="graylog_query" placeholder="*"></label><label>Graylog fetch mode<br><select name="graylog_fetch_mode"><option value="auto">Auto aggregate</option><option value="aggregate">Aggregate + sample</option><option value="raw">Raw only</option></select></label><label>Graylog MCP poll window seconds<br><input name="graylog_range_seconds" type="number" min="60" step="60" placeholder="300"></label><label>Graylog max events per stream<br><input name="graylog_max_events_per_stream" type="number" min="1" step="1000" placeholder="5000"></label><label>Raw sample events per stream<br><input name="graylog_raw_sample_events" type="number" min="1" step="1000" placeholder="5000"></label><label>MCP call timeout seconds<br><input name="graylog_mcp_call_timeout_seconds" type="number" min="1" step="1" placeholder="8"></label><label>MCP poll budget seconds<br><input name="graylog_mcp_poll_timeout_seconds" type="number" min="60" step="30" placeholder="240"></label><label>Baseline training days<br><input name="baseline_training_days" type="number" min="1" step="1" placeholder="7"></label><label>Baseline bucket retention days<br><input name="baseline_retention_days" type="number" min="1" step="1" placeholder="7"></label><label>Baseline value retention days<br><input name="baseline_value_retention_days" type="number" min="1" step="1" placeholder="3"></label><label>Max values per entity field<br><input name="baseline_max_values_per_field" type="number" min="1" step="100" placeholder="500"></label><label>Threat intel provider<br><select name="threat_intel_provider"><option value="auto">Auto</option><option value="abuseipdb">AbuseIPDB</option><option value="virustotal">VirusTotal</option></select></label><label>AbuseIPDB API key<br><input name="abuseipdb_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>VirusTotal API key<br><input name="virustotal_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>Threat intel daily limit<br><input name="threat_intel_daily_limit" type="number" min="1" step="1" placeholder="100"></label><label>Threat intel cache TTL seconds<br><input name="threat_intel_ttl_seconds" type="number" min="60" step="60" placeholder="604800"></label><label>Threat intel error TTL seconds<br><input name="threat_intel_error_ttl_seconds" type="number" min="60" step="60" placeholder="3600"></label><label>AbuseIPDB max age days<br><input name="abuseipdb_max_age_days" type="number" min="1" step="1" placeholder="90"></label><label>Graylog field mapping (JSON)<br><textarea name="graylog_field_mapping" placeholder='{"srcip":"client_ip","dstip":"server_ip","action":"event_action"}'></textarea></label><label>Graylog MCP token<br><input name="graylog_mcp_token" type="password" placeholder="Leave blank to keep current token"></label><label><input name="graylog_tls_verify" type="checkbox"> Verify Graylog TLS certificate</label><label>Ollama model<br><input name="llm_model" placeholder="llama3.1"></label><label>Ollama assessment timeout seconds<br><input name="llm_timeout" type="number" min="1" step="1" placeholder="180"></label><label>Profile advisor model<br><input name="profile_advisor_model" placeholder="qwen3:8b"></label><label>Profile advisor timeout seconds<br><input name="profile_advisor_timeout" type="number" min="1" step="1" placeholder="240"></label><label><input name="llm_enabled" type="checkbox"> Enable Ollama analysis</label><label><input name="profile_advisor_enabled" type="checkbox"> Enable Ollama profile advisor</label><label><input name="threat_intel_enabled" type="checkbox"> Enable threat intelligence</label></div><p><button type="submit">Save configuration</button> <span id="settingsResult" class="muted"></span></p></form></section></div>
+    <div data-view="settings"><section class="panel"><h2>Recommended Stream Profiles</h2><div class="toolbar"><label><input id="showExistingProfiles" type="checkbox"> show existing profiles</label><span id="profileSuggestionSummary"></span></div><div id="profileApplyResult" class="muted" role="status"></div><div id="profileSuggestions" class="muted">Waiting for observed stream data.</div></section><section class="panel"><h2>Installed Ollama Models</h2><div id="ollamaModels" class="muted">Loading local Ollama models.</div></section><section class="panel"><h2>Runtime Configuration</h2><form id="settingsForm"><div class="grid"><label>Log source<br><select name="log_source"><option value="local_syslog">Local syslog</option><option value="graylog_mcp">Graylog MCP</option></select></label><label>Graylog MCP URL<br><input name="graylog_mcp_url" type="url" placeholder="https://graylog.example/api/mcp"></label><label>Enabled streams<br><button type="button" id="loadStreams">Load streams</button><div id="streamPicker" class="muted">Load streams after URL and token are saved.</div></label><label>Profile editor<br><button type="button" id="loadFields">Edit first checked stream profile</button><div id="profileEditorStatus" class="muted">No profile selected for editing.</div><div id="fieldPicker" class="muted">Click Edit profile on one stream.</div></label><label>Profile name<br><input name="profile_name" placeholder="Example: Windows login behavior"></label><label>Detector thresholds (JSON)<br><textarea name="profile_detectors" placeholder='{"auth_failure":{"enabled":true,"minimum":5,"z_threshold":3}}'></textarea></label><label>Field weights (JSON)<br><textarea name="profile_field_weights" placeholder='{"url":1.5,"auth_failure_burst":2,"query_domain":{"rare_value":1.8}}'></textarea></label><label>Behavior relationships (JSON)<br><textarea name="profile_relationship_fields" placeholder='[{"left":"username","right":"srcip","name":"user source IP"}]'></textarea></label><label>Graylog query<br><input name="graylog_query" placeholder="*"></label><label>Graylog fetch mode<br><select name="graylog_fetch_mode"><option value="auto">Auto aggregate</option><option value="aggregate">Aggregate + sample</option><option value="raw">Raw only</option></select></label><label>Graylog MCP poll window seconds<br><input name="graylog_range_seconds" type="number" min="60" step="60" placeholder="300"></label><label>Graylog max events per stream<br><input name="graylog_max_events_per_stream" type="number" min="1" step="1000" placeholder="5000"></label><label>Raw sample events per stream<br><input name="graylog_raw_sample_events" type="number" min="1" step="1000" placeholder="5000"></label><label>MCP call timeout seconds<br><input name="graylog_mcp_call_timeout_seconds" type="number" min="1" step="1" placeholder="8"></label><label>MCP poll budget seconds<br><input name="graylog_mcp_poll_timeout_seconds" type="number" min="60" step="30" placeholder="240"></label><label>Baseline training days<br><input name="baseline_training_days" type="number" min="1" step="1" placeholder="7"></label><label>Baseline bucket retention days<br><input name="baseline_retention_days" type="number" min="1" step="1" placeholder="7"></label><label>Baseline value retention days<br><input name="baseline_value_retention_days" type="number" min="1" step="1" placeholder="3"></label><label>Max values per entity field<br><input name="baseline_max_values_per_field" type="number" min="1" step="100" placeholder="500"></label><label>Threat intel provider<br><select name="threat_intel_provider"><option value="auto">Auto</option><option value="abuseipdb">AbuseIPDB</option><option value="virustotal">VirusTotal</option></select></label><label>AbuseIPDB API key<br><input name="abuseipdb_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>VirusTotal API key<br><input name="virustotal_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>Threat intel daily limit<br><input name="threat_intel_daily_limit" type="number" min="1" step="1" placeholder="100"></label><label>Threat intel cache TTL seconds<br><input name="threat_intel_ttl_seconds" type="number" min="60" step="60" placeholder="604800"></label><label>Threat intel error TTL seconds<br><input name="threat_intel_error_ttl_seconds" type="number" min="60" step="60" placeholder="3600"></label><label>AbuseIPDB max age days<br><input name="abuseipdb_max_age_days" type="number" min="1" step="1" placeholder="90"></label><label>Graylog field mapping (JSON)<br><textarea name="graylog_field_mapping" placeholder='{"srcip":"client_ip","dstip":"server_ip","action":"event_action"}'></textarea></label><label>Graylog MCP token<br><input name="graylog_mcp_token" type="password" placeholder="Leave blank to keep current token"></label><label><input name="graylog_tls_verify" type="checkbox"> Verify Graylog TLS certificate</label><label>Ollama model<br><input name="llm_model" placeholder="llama3.1"></label><label>Ollama assessment timeout seconds<br><input name="llm_timeout" type="number" min="1" step="1" placeholder="180"></label><label>Profile advisor model<br><input name="profile_advisor_model" placeholder="qwen3:8b"></label><label>Profile advisor timeout seconds<br><input name="profile_advisor_timeout" type="number" min="1" step="1" placeholder="240"></label><label>Profile advisor interval seconds<br><input name="profile_advisor_interval_seconds" type="number" min="60" step="30" placeholder="300"></label><label>Field confidence threshold<br><input name="field_confidence_threshold" type="number" min="0" max="100" step="1" placeholder="60"></label><label>Field confidence history retention days<br><input name="field_confidence_retention_days" type="number" min="1" step="1" placeholder="90"></label><label><input name="llm_enabled" type="checkbox"> Enable Ollama analysis</label><label><input name="profile_advisor_enabled" type="checkbox"> Enable Ollama profile advisor</label><label><input name="auto_apply_profile_suggestions" type="checkbox"> Auto-apply high-confidence stream profiles</label><label><input name="threat_intel_enabled" type="checkbox"> Enable threat intelligence</label></div><p><button type="submit">Save configuration</button> <span id="settingsResult" class="muted"></span></p></form></section></div>
     <div data-view="howto"><section class="panel"><h2>How To Use SignalScope</h2><div class="howto-grid"><div class="howto-card"><h3>1. Normal workflow</h3><ol><li>Settings: connect Graylog MCP and enable streams.</li><li>Settings: apply recommended profiles for missing streams.</li><li>Diagnostics: confirm raw samples, aggregate counts, and profile readiness.</li><li>Overview: use Operator Guidance, incidents, trends, and correlation map.</li><li>Findings: review only high-signal deviations first, then mark decisions.</li></ol></div><div class="howto-card"><h3>2. Stream health</h3><ul><li><b>ready</b>: profile exists, events are arriving, and baseline fields are ready.</li><li><b>learning</b>: profile exists and events arrive, but baseline age or buckets are still too low.</li><li><b>missing_profile</b>: stream is enabled but no profile exists. Apply or edit one.</li><li><b>no_events</b>: stream is enabled but the current poll has no raw sample events.</li><li><b>partial_fetch</b>: Graylog returned only part of the requested raw sample.</li></ul></div><div class="howto-card"><h3>3. Ready fields</h3><p><code>0/8</code> means 8 profile fields are tracked but none are mature enough yet. A field needs at least 12 baseline buckets and the configured Baseline training days before it is ready.</p><p>During learning, treat findings as signals to tune profiles, not as final alerts.</p></div><div class="howto-card"><h3>4. Profiles</h3><ul><li><b>Entity fields</b> define who or what behavior is tracked, such as user, host, source IP, or application actor.</li><li><b>Baseline fields</b> define the changing behavior to learn, such as action, event ID, service, URL, status, or counters.</li><li><b>Relationships</b> learn pairs such as username to srcip or host to process.</li><li><b>Detectors</b> add burst checks for auth failures, DNS queries, and deny actions.</li></ul></div><div class="howto-card"><h3>5. Findings</h3><ul><li>Start with Triage Queue and incidents, not raw long tables.</li><li>Open evidence details before confirming a finding.</li><li>Use Expected for known behavior, False positive for bad signal, Confirmed for real investigation items.</li><li>Use expiry when a behavior is expected only temporarily.</li></ul></div><div class="howto-card"><h3>6. High EPS / MCP</h3><ul><li>Use aggregate or auto fetch mode for high EPS streams.</li><li>Keep raw samples small enough for context; aggregate counts represent the full window.</li><li>Sample capped is normal in aggregate mode. Truncated raw mode means you may miss context.</li><li>If MCP is stale, the UI shows cached status so you can still inspect previous findings.</li></ul></div><div class="howto-card"><h3>7. Ollama</h3><ul><li>Dashboard assessment summarizes current evidence.</li><li>Profile advisor maps unknown/custom fields and suggests relationships.</li><li>Ollama advice is constrained to fields discovered from Graylog; unknown fields are rejected.</li></ul></div><div class="howto-card"><h3>8. Baseline DB size</h3><ul><li>Baseline DB size is the local SQLite behavior baseline.</li><li>Retention deletes old rows, but SQLite only returns disk space after manual VACUUM.</li><li>If the DB grows fast, lower bucket retention, value retention, or max values per entity field in Settings.</li><li>Stop the service before running <code>signalscope baseline-maintenance --vacuum</code>.</li></ul></div><div class="howto-card"><h3>9. What to fix first</h3><ol><li>No streams enabled.</li><li>Enabled streams with missing profiles.</li><li>Enabled streams with zero raw events.</li><li>Profiles stuck at 0 ready fields after the training window.</li><li>Too many repeated findings without review feedback.</li><li>Baseline DB growing without maintenance.</li></ol></div></div></section></div>
       </section>
     </section>
@@ -1103,6 +1103,10 @@ async function applySuggestedProfile(streamId) {
       profile_advisor_enabled: Boolean(config.profile_advisor_enabled),
       profile_advisor_model: config.profile_advisor_model || 'qwen3:8b',
       profile_advisor_timeout: config.profile_advisor_timeout || 240,
+      profile_advisor_interval_seconds: config.profile_advisor_interval_seconds || 300,
+      field_confidence_threshold: config.field_confidence_threshold ?? 60,
+      field_confidence_retention_days: config.field_confidence_retention_days || 90,
+      auto_apply_profile_suggestions: Boolean(config.auto_apply_profile_suggestions),
       threat_intel_enabled: Boolean(config.threat_intel_enabled),
       threat_intel_provider: config.threat_intel_provider || 'auto',
       threat_intel_daily_limit: config.threat_intel_daily_limit || 100,
diff --git a/tests/test_dashboard.py b/tests/test_dashboard.py
index bf3e119..b6b9471 100644
--- a/tests/test_dashboard.py
+++ b/tests/test_dashboard.py
@@ -115,6 +115,13 @@ class DashboardTests(unittest.TestCase):
         self.assertIn('name="llm_timeout"', HTML)
         self.assertIn("llm_timeout: config.llm_timeout || 180", HTML)
 
+    def test_dashboard_exposes_field_confidence_and_auto_apply_settings(self):
+        self.assertIn('name="field_confidence_threshold"', HTML)
+        self.assertIn('name="profile_advisor_interval_seconds"', HTML)
+        self.assertIn('name="field_confidence_retention_days"', HTML)
+        self.assertIn('name="auto_apply_profile_suggestions"', HTML)
+        self.assertIn("field_confidence_threshold: config.field_confidence_threshold ?? 60", HTML)
+
 
 if __name__ == "__main__":
     unittest.main()