Read network traffic as evidence to be interpreted under two hard limits — you usually cannot see the payload (encryption) and rare is usually benign (base rates) — never as a verdict on its own; beaconing, JA3/JA4 fingerprints, timing, volume, and destination reputation are weak signals whose meaning lives in baseline and context.
