{"database": "audit", "table": "anomaly_baseline_hourofday", "rows": [["app:scan", "scan", 16, 155, 1040, "2026-05-21 06:58:54"]], "columns": ["source", "actor", "hour", "event_count", "total_count", "learned_at"], "primary_keys": ["source", "actor", "hour"], "primary_key_values": ["app:scan", "scan", "16"], "units": {}, "query_ms": 17.352076014503837}