01
Different layers, different jobs
Edge systems see events first and operate under tight constraints. Central systems can integrate broader context but pay for data movement and latency. A useful architecture assigns each layer work proportional to its strengths.
02
The handoff is the product
Local detection is only the beginning. The central system needs a compact, trustworthy package of evidence: what changed, why it appears unusual, how confident the detector is, and what context should be gathered next.
03
Evaluation must stay operational
Accuracy alone cannot settle the design. Latency, compute, bandwidth, false-alarm burden, explanation quality, and the cost of missing a meaningful event all belong in the evaluation.