By NicolasSb
Writes hostprofile_features.log: every 5 minutes, one row of 17 features per active local host, from its connections, DNS queries and TLS server names (volume, diversity, novelty, failures, rhythm and beaconing), ready for anomaly detection or ML. Works standalone and on Broker or ZeroMQ clusters.