configurable per-field detector weights är klart.

README.md

@@ -20,6 +20,9 @@ Autoblocking is dry-run by default. The tool will not block RFC1918, loopback, m
 ### Findings
 ![Findings](images/findings.jpg)
 
+### Correlation
+![Correlation](images/correlation.jpg)
+
 ## Quick Start
 
 ```bash
@@ -85,6 +88,23 @@ baselines for authentication failures, DNS queries, and deny/block actions when
 those events are present. These are evaluated per configured entity, so a Windows
 account, DNS client, or firewall source is compared to its own history.
 
+Stream profiles can also carry `field_weights` to tune scoring without changing
+the baseline itself. Weights are multipliers from `0` to `5` and can target a
+field, a detector, or a field+detector pair:
+
+```json
+{
+  "url": 1.5,
+  "auth_failure_burst": 2,
+  "query_domain": {
+    "rare_value": 1.8
+  }
+}
+```
+
+Use replay or `replay-graylog --compare-config-file` to test score changes before
+applying them to the live profile.
+
 Replay a historic JSONL or Graylog export without changing the live baseline:
 
 ```bash