Most monitoring systems are very good at spotting single events: a large transfer, a sudden spike, an unusual destination, a customer who moves much faster than before. Daisy chains are different.