Anomaly alerts

Automatic detection of unusual DNS activity (volume spikes, block surges, sudden domain bursts) compared with your 7-day baseline.