So they need more data from healthy patients when they're healthy in order to determine what's anomalous? SIEM tools do anomaly detection with lots of textual

So they need more data from healthy patients when they're healthy in order to determine what's anomalous? SIEM tools do anomaly detection with lots of textual log data and sensor data. What would a Cost-effectiveness analysis say about collecting data from healthy patients: https://en.wikipedia.org/wiki/Cost-effectiveness_analysis https://en.wikipedia.org/wiki/Cost-effectiveness_analysis TIL the ROC curve applies to medical tests.