Signal Streams
A Signal Stream is a configured detection focus inside Vantage. It defines a narrative pressure point on your organization, the behavior Vantage should treat as a threat around it, where and in which languages to look, and when the threat is most likely to surge. Every subscription includes an unlimited number of Signal Streams. Your configuration specialist builds them with you from your Narrative Assessment, and Vantage runs detection against them continuously.
Why Signal Streams exist
Your Information Landscape is everything Vantage captures for your subscription: every Asset and Publication across the platforms, languages, and geographies scoped to who is targeting you. That breadth is deliberate. You can only tell what is abnormal when you can see what is normal.
Detection needs something narrower. A threat to a bank preparing an earnings release looks different from a threat to an election commission, and both look different from a slow structural campaign against a constitutional process. A Signal Stream gives Vantage that specificity: which meaning to track across paraphrases and translations, which TTPs count as a signal, which audiences matter, and which windows carry elevated risk.
A Signal Stream is not a keyword, a topic, or a search query. A keyword tells the platform which words to find. A Signal Stream tells it what kind of threat to look for, on which surfaces, against which audiences, and what separates a meaningful signal from noise.
What a Signal Stream contains
Each Signal Stream has a stream ID and a name, and is specified across the following components.
Priority
Each Signal Stream carries a priority that reflects how much standing readiness it requires.
Priority is set on potential impact, speed of spread, and detectability, weighted by which stakeholder tier the narrative reaches. Streams are then grouped into tiers that mirror your own response architecture: which demand sub-4-hour readiness, which require executive or legal sign-off before engagement, and which teams own each escalation path.
Critical
Active adversary capability, high reach potential, often compressed around an event. Standing detection and response readiness required throughout the activation window.
High
High or medium-high impact, and either fast spread or hard-to-detect activity.
Medium
Medium impact, slow to moderate spread. Structural pressure rather than an acute spike.
Elevated
Persistent ambient condition rather than event-driven. Long-cycle pressure with annual or milestone-driven peaks.
How Signal Streams are built
Signal Streams are derived. Every stream traces back to a specific finding in your Narrative Assessment, the upstream analysis that maps your stakeholders, the fault lines an adversary is most likely to exploit, the adversary's likely tactics, and the strategic intent behind them.
Between the assessment and the finished configuration sits a structured diagnostic conversation with your configuration specialist. For each candidate stream it answers two questions:
What do you want to be alerted on?
Whether the stream should track a topic however it appears, or only when it behaves a certain way: coordinated amplification, impersonation, bot-like networked spread, or any form during a sensitive window or from a high-authority source. Whose information space matters most. Whether cross-language movement matters.
What should make it fire, and when?
The alert conditions (clear coordination, a reach or velocity threshold, arrival in a protected audience, an impersonation, a landing inside a sensitive window) and the required speed to notice. Fabricated documents, impersonations, and verified coordination typically warrant same-hour notice; slower structural narratives warrant same-day.
How Signal Streams relate to the rest of Vantage
Reference Assets, the accounts and channels you own or treat as fixed reference points, sit outside the classification pipeline. They let you measure your own reach and timing against the malign and organic activity a stream surfaces.
Whatever the depth, streams are unlimited within your subscription. Most customers settle in the four-to-twelve range. Streams without a kernel truth, named owners, and a response framework produce noise rather than intelligence, so your configuration specialist works with you to design streams that produce decisions.
Keeping streams current
Every detection Vantage produces carries analysis: who started the activity, how fast it spread, whether it was coordinated, and what made the landscape receptive. That analysis feeds back into your configuration. A previously unmapped narrative reveals a fault line the assessment missed. A new tactic pattern updates the detection logic. A new platform used for amplification extends the vector map.
Configurations refresh on a defined cadence within your subscription band. Streams documented in your assessment but not active in the current cycle are held for continuity and can be activated by amendment.
Related pages
- Building your signal streamsBuilding your signal streams
- Changing your landscapeChanging your landscape
- Point AlertPoint Alert