Anomalous-Pattern Alerts (APA)
The directorate's tripwire — novel pattern signatures surfacing against baseline. A spike often precedes a new technique going wide.
Interpretation
This metric provides operational visibility into instrumentation mesh performance. Changes in value should be interpreted in the context of current threat levels and recent counter-operations. GOVERNOR uses this reading alongside related metrics to maintain a composite picture of directorate readiness.
Formula
Thresholds & Bands
| Band | Range | State |
|---|---|---|
| Quiet | <15/day | ok |
| Active | 15-40/day | warn |
| Storm | >40/day | crit |
Data Collection
Computed by GOVERNOR from its internal decision log and state tables. Values are deterministic — the same input state always yields the same reading.
GOVERNOR Behavior
Quiet (<15/day): GOVERNOR logs the reading, updates the standing dashboard, and takes no further action. Active (15-40/day): GOVERNOR escalates to an advisory notification. The on-duty watch officer receives an alert, and the metric is flagged in the next Steward briefing if the condition persists for two consecutive reporting periods. Storm (>40/day): GOVERNOR triggers an immediate escalation. The Steward is notified directly, the relevant department head is paged, and all related dashboards enter amber-alert mode until the reading recovers above the warning threshold.