Run Z-score anomaly detection on a device's recent telemetry. Steps: 1. 2. Review detected anomaly types (spike, flatline, drift, oscillation, pattern-break, cluster-outlier) 3. If score 0.9, recommend quarantine 4. Store anomaly pattern for learning: ---