Looks at observed logs per stream.

Finds common denominators:

tests/test_profile_suggestions.py

@@ -0,0 +1,27 @@
+import unittest
+
+from fgai.logs import parse_log_line
+from fgai.profile_suggestions import suggest_stream_profiles
+
+
+class ProfileSuggestionTests(unittest.TestCase):
+    def test_suggests_common_profile_fields_per_stream(self):
+        events = [
+            parse_log_line(f"fgai_stream_id=firewall fgai_stream=Firewall srcip=10.0.0.{index} dstip=8.8.8.8 dstport=443 action=deny timestamp=2026-06-29T10:00:{index:02d}Z hitcount={index}")
+            for index in range(1, 25)
+        ]
+
+        suggestions = suggest_stream_profiles(events)
+        profile = suggestions[0]["profile"]
+
+        self.assertEqual(profile["stream_id"], "firewall")
+        self.assertIn("srcip", profile["entity_fields"])
+        self.assertEqual(profile["timestamp_field"], "eventtime")
+        self.assertIn("action", profile["categorical_fields"])
+        self.assertIn("dstport", profile["categorical_fields"])
+        self.assertIn("hitcount", profile["numeric_fields"])
+        self.assertIn("deny_action", profile["detectors"])
+
+
+if __name__ == "__main__":
+    unittest.main()