Implement a state machine (attack graph, perhaps?) to track observed signals as they build toward an alert.