Which sender → recipient pair just spiked above its baseline? Rolling 2-day SUM per pair vs. the population mean + standard deviation. Drag the σ slider to flag the tail. The distribution chart shows the full population — your slider cutoff against that shape — while the KPI + table show only flagged windows.
Pair-windows whose 2-day rolling SUM clears the σ threshold.
Pair-windows bucketed by |z-score| against the population mean. Chart is intentionally NOT filtered by the σ slider.
One row per flagged 2-day window. Ranked by z-score (highest = furthest from the population mean).