Appendix 2: Monitoring: Learning "Normal" Patterns