Goals

• Model realistic enterprise communication, not only random 5-tuples.
• Keep protocol encoders behind a neutral flow model.
• Provide reproducible test datasets through seeds and YAML configs.
• Support normal traffic as the dominant signal with low-weight security telemetry.
• Validate collector parsing, normalization, enrichment, queueing, and storage.
• Avoid false vendor compatibility claims.