Looks at observed logs per stream.

Finds common denominators:

ROADMAP.md

@@ -35,6 +35,7 @@ Goal: make findings more accurate before adding more integrations.
 - [ ] Add dashboard controls for launching safe replay jobs and viewing detector deltas.
 - [ ] Add baseline confidence tooling: per detector learning state, expected false-positive rate, and why a deviation crossed threshold.
 - [ ] Add baseline maintenance tooling in the dashboard for retention, high-cardinality fields, and database compaction status.
+- [x] Add observed-field profile recommendations so streams can get suggested entity, time, categorical, numeric, and detector settings.
 
 Acceptance: each finding shows its detector, confidence, baseline sample count, current value, expected value, and a bounded set of raw-event references.
 
@@ -112,6 +113,7 @@ Goal: add log sources and outputs without adding source-specific logic everywher
 - [ ] Define versioned stream-profile templates for FortiGate, Windows, DNS/AdGuard, Nginx, Squid, VPN, and Proxmox.
 - [x] Add inventory-style stream coverage to guide which streams need profiles before templates are added.
 - [x] Add common alias normalizer so new firewall/proxy/DNS streams can populate source, destination, action, severity, service, and context without source-specific code.
+- [x] Add generated stream-profile recommendations from observed common denominators.
 - [ ] Add import/export for profile templates and detector settings.
 - [ ] Separate source adapters, normalizers, detectors, enrichers, and output adapters into explicit extension interfaces.
 - [ ] Add optional webhook/SIEM ticket output for confirmed high-severity incidents.