--- title: Signal Streams slug: signal-streams createdAt: 2026-06-26T03:15:35.794Z --- :::hint{type="custom" customColor="#B91C1C"} A Signal Stream is a configured detection focus inside Vantage. It defines a narrative pressure point on your organization, the behavior Vantage should treat as a threat around it, where and in which languages to look, and when the threat is most likely to surge. Every subscription includes an unlimited number of Signal Streams. Your configuration specialist builds them with you from your Narrative Assessment, and Vantage runs detection against them continuously. ::: ## Why Signal Streams exist Your Information Landscape is everything Vantage captures for your subscription: every Asset and Publication across the platforms, languages, and geographies scoped to who is targeting you. That breadth is deliberate. You can only tell what is abnormal when you can see what is normal. Detection needs something narrower. A threat to a bank preparing an earnings release looks different from a threat to an election commission, and both look different from a slow structural campaign against a constitutional process. A Signal Stream gives Vantage that specificity: which meaning to track across paraphrases and translations, which TTPs count as a signal, which audiences matter, and which windows carry elevated risk. :::hint{type="info"} A Signal Stream is not a keyword, a topic, or a search query. A keyword tells the platform which words to find. A Signal Stream tells it what kind of threat to look for, on which surfaces, against which audiences, and what separates a meaningful signal from noise. ::: ## What a Signal Stream contains Each Signal Stream has a stream ID and a name, and is specified across the following components. ::::ExpandableHeading{isOpen="true"} ### Kernel truth The documented, public-record facts the stream is built around. The stream defends against manipulation of the facts, never against the facts themselves. :::hint{type="note"} **Example (Armenia, pre-election configuration):** The TRIPP corridor and the proposed 99-year lease traversing Syunik are matters of active diplomatic negotiation, and a majority of the public polled against them. ::: :::: ::::ExpandableHeading{isOpen="true"} ### Behavioral pattern The TTPs that mark the activity as engineered: a volume spike from newly created Assets pushing identical framing, coordinated amplification of one artifact, impersonation of officials or official channels. :::hint{type="note"} **Example (Armenia, pre-election configuration):** Selective excerpts from diplomatic documents recombined as "leaked" treaty fragments, then amplified in synchrony across platforms during diplomatic news cycles. ::: :::: ::::ExpandableHeading{isOpen="true"} ### Narrative focus The meaning being conveyed, tracked as a cluster across paraphrases, euphemisms, and languages, with the claims already observed in the wild. See methodology on Narrative Extraction here. :::hint{type="note"} **Example (Armenia, pre-election configuration):** "Pashinyan signed away Syunik to the Americans for 99 years." ::: :::: ::::ExpandableHeading{isOpen="true"} ### Audiences and adversaries Who the narrative is built to reach, and who is likely producing it. :::hint{type="note"} **Example (Armenia, pre-election configuration):** Domestic electorate and Russian-speaking diaspora; Russian state-aligned amplification infrastructure and a domestic Telegram cluster. ::: :::: ::::ExpandableHeading{isOpen="true"} ### Vectors The Platforms, Websites, and languages in scope for this stream, and the role each plays. :::hint{type="note"} **Example (Armenia, pre-election configuration):** Telegram as the primary propagation surface; X for diplomatic-press speculation; Facebook and Instagram for diaspora reach; Meta Ads for paid amplification. Armenian, Russian, English. ::: :::: ::::ExpandableHeading{isOpen="true"} ### Timing and triggers Calendar windows and event triggers during which the stream escalates. :::hint{type="note"} **Example (Armenia, pre-election configuration):** Continuous baseline, elevated on any new corridor filing; compressed posture in the final 72 hours before polling; post-election watch through the count window. ::: :::: ::::ExpandableHeading{isOpen="true"} ### Detection plan and response framework What Vantage detects for this stream, and which of your teams owns each response path. :::hint{type="note"} **Example (Armenia, pre-election configuration):** Vantage: coordinated-amplification detection and provenance checks on high-view diplomatic imagery. Client Security: lookalike-domain alerts. Client Legal: pre-positioned filing pathway. ::: :::: ::::ExpandableHeading{isOpen="true"} ### Cross-stream links Other streams this one compounds with or shares infrastructure with. :::hint{type="note"} **Example (Armenia, pre-election configuration):** The corridor stream links to the election-integrity stream (shared 72-hour window) and to the synthetic-media stream (shared impersonation detection). ::: :::: ## Priority Each Signal Stream carries a priority that reflects how much standing readiness it requires. Priority is set on potential impact, speed of spread, and detectability, weighted by which stakeholder tier the narrative reaches. Streams are then grouped into tiers that mirror your own response architecture: which demand sub-4-hour readiness, which require executive or legal sign-off before engagement, and which teams own each escalation path. ::::LinkArray{contentSource="CUSTOM" itemsPerRow="2"} :::LinkArrayItem ### Critical Active adversary capability, high reach potential, often compressed around an event. Standing detection and response readiness required throughout the activation window. ::: :::LinkArrayItem ### High High or medium-high impact, and either fast spread or hard-to-detect activity. ::: :::LinkArrayItem ### Medium Medium impact, slow to moderate spread. Structural pressure rather than an acute spike. ::: :::LinkArrayItem ### Elevated Persistent ambient condition rather than event-driven. Long-cycle pressure with annual or milestone-driven peaks. ::: :::: ## How Signal Streams are built Signal Streams are derived. Every stream traces back to a specific finding in your Narrative Assessment, the upstream analysis that maps your stakeholders, the fault lines an adversary is most likely to exploit, the adversary's likely tactics, and the strategic intent behind them. Between the assessment and the finished configuration sits a structured diagnostic conversation with your configuration specialist. For each candidate stream it answers two questions: ::::VerticalSplit{layout="middle"} :::VerticalSplitItem **What do you want to be alerted on?** Whether the stream should track a topic however it appears, or only when it behaves a certain way: coordinated amplification, impersonation, bot-like networked spread, or any form during a sensitive window or from a high-authority source. Whose information space matters most. Whether cross-language movement matters. ::: :::VerticalSplitItem **What should make it fire, and when?** The alert conditions (clear coordination, a reach or velocity threshold, arrival in a protected audience, an impersonation, a landing inside a sensitive window) and the required speed to notice. Fabricated documents, impersonations, and verified coordination typically warrant same-hour notice; slower structural narratives warrant same-day. ::: :::: ## How Signal Streams relate to the rest of Vantage ::::Tabs :::Tab{title="Point Alerts"} Detection runs continuously against the Information Landscape. When activity matching a stream's behavioral pattern crosses the stream's threshold, Vantage assembles a Point Alert: what was detected, which Assets and Narratives are involved, why it matters, and a recommended action. The Signal Stream is what makes the alert specific to your threat model rather than a generic volume trigger. ::: :::Tab{title="Narrative Pulse"} Narrative Pulse shows every Narrative moving through your Information Landscape, whether or not anything has crossed a stream's threshold. Signal Streams are the reflex; Narrative Pulse is the peripheral vision. A stream-only view shows you only what you predicted. A landscape-only view is noise. Together they close the loop. ::: :::Tab{title="Reference Assets"} Reference Assets, the accounts and channels you own or treat as fixed reference points, sit outside the classification pipeline. They let you measure your own reach and timing against the malign and organic activity a stream surfaces. ::: :::: :::hint{type="success"} Whatever the depth, streams are unlimited within your subscription. Most customers settle in the four-to-twelve range. Streams without a kernel truth, named owners, and a response framework produce noise rather than intelligence, so your configuration specialist works with you to design streams that produce decisions. ::: ## Keeping streams current Every detection Vantage produces carries analysis: who started the activity, how fast it spread, whether it was coordinated, and what made the landscape receptive. That analysis feeds back into your configuration. A previously unmapped narrative reveals a fault line the assessment missed. A new tactic pattern updates the detection logic. A new platform used for amplification extends the vector map. :::hint{type="info"} Configurations refresh on a defined cadence within your subscription band. Streams documented in your assessment but not active in the current cycle are held for continuity and can be activated by amendment. ::: ## Related pages - [Building your signal streams](docId\:DR_XHq3yb6SC-PuunjuBZ) - [Changing your landscape](docId\:yPSHILLUz6KKeaRiMNunj) - [Point Alert](docId\:unlKYV8U4TtEamnZR14Iu)