network observability

Build a Linux-first, open, no-black-boxes, Bash-automated pipeline for AI network observability: use TShark to capture encrypted-friendly flow metadata, featurize to CSV, train an Isolation Forest, and score new traffic to surface anomalies like scans, exfiltration, and beaconing. Includes install steps, scripts, cron/systemd automation, tuning, trade-offs, and paths to scale and SIEM integration.