Detection thresholds
Open methodology: the thresholds below are stored and shown openly. Changing them re-scans every region and rebuilds the alert audit log.
How a spike is detected
- The schema holds only region + date + count — no individual record can exist.
- Baseline = trailing mean over the rolling window; z = (count − mean) / stddev.
- z ≥ warning → warning; z ≥ watch → watch. Thresholds are stored and displayed here.
- Sparse regions (fewer than the minimum observations) are marked insufficient and never false-spike.
- Every alert is written to a hash-chained audit log with its threshold.