add relationship fields

README.md

@@ -162,6 +162,13 @@ contain them. This lets late-arriving or less frequent fields such as custom
 `lcs_*` application fields stay visible long enough to be reviewed and appended
 to an existing profile.
 
+Shared-field discovery is also used as the base for cross-source correlation.
+SignalScope groups exact aliases and broader semantic families such as source IP,
+user, host, ID, status/result, action, type/category, domain, URL, and custom
+namespaces such as `lcs_*`. These shared groups are the foundation for a global
+correlation profile and future flow graphs that show how users, hosts, IPs,
+applications, IDs, statuses, and destinations relate across streams.
+
 Enabled streams are normalized through the same event model. Stream profiles
 define the entity, timestamp, categorical, and numeric fields used for baselines.
 The dashboard and Ollama then correlate behavior across sources, for example a
@@ -173,6 +180,29 @@ A stream profile can track multiple entities from the same event, such as
 each selected entity value, which makes cross-source investigation work even when
 one source is user-centric and another is IP- or host-centric.
 
+Profiles can also track field relationships as behavior patterns. This is useful
+when the suspicious signal is not a single new value, but a new combination such
+as a known user logging in successfully from a source IP that has never been seen
+for that user before. Add `relationship_fields` to a stream profile, for example:
+
+```json
+[
+  {
+    "stream_id": "windows-security",
+    "entity_field": "username",
+    "categorical_fields": ["action", "eventid"],
+    "relationship_fields": [
+      {"left": "username", "right": "srcip", "name": "user source IP"},
+      {"left": "username", "right": "hostname", "name": "user host"}
+    ]
+  }
+]
+```
+
+After the baseline has learned those relationships, a new `username -> srcip` or
+`username -> hostname` pair is reported as `new_relationship` with sample events.
+The dashboard profile editor exposes this as `Behavior relationships (JSON)`.
+
 SignalScope keeps a common alias map for fields such as source IP, destination
 IP, ports, action, severity, service/protocol, DNS query, URL, message, and event
 type. This lets Related Activity and correlations work with firewall/proxy/DNS