Example: Run `last_seen:1d classification:benign" once per day to populate a lookup table that can be used for enrichment and suppression.