Short-Window Micro-Behavioral Triage for High-Throughput Firewall Telemetry: Limits, Features, and Operational...

High-throughput firewall telemetry increasingly demands real-time interpretation from short, dense observation windows rather than long historical baselines. We operationalize behavioral slicing, a privacy-preserving approach that extracts interpretable micro-behavioral signals-timing irregularities, destination dispersion (entropy), and intensity cues-from sub-minute traffic segments. This study does not claim confirmed intrusion detection. Instead, it evaluates whether short-window firewall telemetry can support privacy-preserving candidate triage under high-throughput conditions and quantifies the limits, feature stability, detector complementarity, and real-time feasibility of such a pipeline. Our case study uses a real operational firewall telemetry slice that was irreversibly anonymized prior to analysis. Using unsupervised outlier detection with explainable summaries, the slice-level pipeline produces investigation-oriented anomaly candidates for triage, without making longitudinal routine or habit claims. Synthetic anomaly injection is used only for relative validation, while behavioral findings are derived from the real telemetry slice. Scenario-level ablations show strong separation for scanning and exfiltration but weak performance for low-variance C2 beaconing, indicating that behavioral slicing should be treated as a triage pre-filter rather than a universal detector. In the context of IoT and edge-network monitoring, firewall telemetry can be treated as a high-rate network sensing stream that reflects device-level communication behavior under operational constraints. Overall, results support behavioral slicing as an operationally feasible pre-filtering and triage method under extreme network load, with clear trade-offs and limits.