Continued the Detection Quality roadmap.

README.md

@@ -80,6 +80,21 @@ Graylog event is not learned repeatedly. Related anomalies, profile deviations,
 and multi-stream correlations are grouped into investigation incidents with a
 compact evidence timeline.
 
+With a stream profile in place, SignalScope also builds independent burst
+baselines for authentication failures, DNS queries, and deny/block actions when
+those events are present. These are evaluated per configured entity, so a Windows
+account, DNS client, or firewall source is compared to its own history.
+
+Replay a historic JSONL or Graylog export without changing the live baseline:
+
+```bash
+signalscope replay --logs exports/windows-history.jsonl --stream-id <configured-stream-id>
+```
+
+Replay uses a temporary SQLite baseline and evaluates events in timestamp order.
+It reports detector counts and the findings that would have been generated. Use
+the configured stream ID so the export is evaluated with that stream's profile.
+
 The current MCP endpoint is `http://<graylog-host>:9000/api/mcp`. Enable it in
 Graylog under `System -> Configurations -> MCP` and use stream IDs internally;
 the fgAI stream picker resolves titles in the UI.