You're right on. In theory, you could train our system to recognize good behavior if you sent us enough $label events, but most of the patterns we have today are really optimized around detecting bad behavior.