Research

Evidence-backed real-time signal detection for webhook agent alerts

This page documents how TrendsAGI models event velocity, calibrates thresholds, and routes structured webhook alerts. The objective is operational: shorten time-to-action while preserving verification quality.

Signal Definitions

We treat cultural-moment detection as a streaming decision system. Metrics are defined so rules can be audited, tuned, and mapped to deterministic actions.

MetricFormalizationPurposeImplementation Note
Velocitymentions/hour or events/minuteMeasures current spread intensityPrimary trigger axis for monitor/notify/act tiers
Accelerationd(velocity)/dt over rolling windowsSeparates stable high-volume chatter from breakout movementEscalate if acceleration remains positive across two windows
Source Diversityentropy over source clustersReduces single-source amplification noiseRequire minimum distinct cluster count before high severity
Persistenceminutes above thresholdImproves precision by rejecting brief spikesGate action tier until sustained for N minutes
Anomaly Scoredeviation vs adaptive baselineDetects out-of-pattern behavior per topicRoute to triage queue if anomaly score exceeds configured bound

Detection Pipeline

Structured pipeline design keeps detection explainable and reduces coupling between signal computation and downstream automation.

Observe
01

Collect source events and metadata from monitored channels.

Next: Normalize
Normalize
02

Apply dedupe, token mapping, timezone alignment, and entity extraction.

Next: Detect
Detect
03

Compute velocity, acceleration, persistence, and anomaly deltas.

Next: Route
Route
04

Apply tenant rules for severity, category, and destination endpoint.

Next: Verify
Verify
05

Validate signature + freshness before automation consumes the payload.

Next: Learn
Learn
06

Review false positives, update thresholds, and adapt to concept drift.

Evidence Matrix

The matrix links literature findings to concrete product decisions. Cross-domain research is used as methodological support and is explicitly caveated when applied to marketing workflows.

FindingSourceProduct ImplicationImplementation Note
Collective attention accelerates over time; response windows compress.[R1]Detection latency must be minimized for campaign relevance.Favor low-latency ingestion and early-stage triggering.
Real-time message timing improves engagement outcomes.[R2]Operational timing is a product capability, not only a content problem.Optimize time-to-brief and time-to-first-publish SLAs.
Newsjacking effectiveness depends on topical fit and speed.[R3]Alerting must include context, not only counts.Attach rationale fields in webhook payloads for triage confidence.
Social streams can act as real-time event sensors.[R4]Event-detection methods transfer to marketing moment sensing.Treat transfer as methodological support, not direct causality proof.
Burst detection in streams identifies emerging attention states.[R5]Burst models can power initial detect and escalation boundaries.Use burst + persistence together to improve precision.
Concept drift requires continuous threshold adaptation.[R6]Static thresholds decay as topic baselines move.Run periodic calibration from accepted/rejected alert outcomes.
Incident response guidance emphasizes playbooks and verification.[R7]Webhook alerts should map to explicit response runbooks.Route by severity to deterministic workflows.

Transfer caveat: references [R4]-[R7] originate from event detection, stream mining, and incident response domains. We use them to justify detection architecture and response design, not to claim direct marketing outcome equivalence.

Threshold Calibration

Tiered thresholds make precision and recall tradeoffs explicit. Start conservative, then tighten using accepted and rejected alert outcomes.

TierSuggested ConditionObjectivePrecision/Recall TradeoffAutomated Action
Monitorvelocity >= 3x baseline OR anomaly >= mediumHigh recall, lower precisionCaptures weak signals; accepts analyst review loadLog signal and append context to monitoring queue
Notifyvelocity >= 10x baseline AND persistence >= 15mBalanced precision/recallFilters short-lived bursts while preserving early detectionNotify channel owner and create brief draft
Actvelocity >= 25x baseline AND diversity >= thresholdHigher precision, lower false escalationMay miss very early single-cluster eventsTrigger webhook-runbook automation with assignee routing

Webhook Contract

Webhook payloads are structured for deterministic routing. Consumers should verify signature, timestamp freshness, and schema compatibility before taking action.

POST https://your-webhook-endpoint
X-Webhook-Signature: <hmac-sha256>
X-Webhook-Timestamp: <unix-epoch-seconds>
Content-Type: application/json

{
  "trigger_type": "trend_velocity",
  "tier": "notify",
  "trend_name": "airport closure + storm",
  "velocity": 2400,
  "acceleration": 1.8,
  "source_diversity": 0.74,
  "persistence_minutes": 19,
  "sentiment": "neutral",
  "timestamp": "2026-02-05T18:42:00Z",
  "summary": "Closure chatter accelerated across Northeast travel sources.",
  "source_link": "https://trendsagi.com/blog"
}
1. Verify
Validate HMAC signature and reject stale timestamps.
2. Route
Map tier/category to queue, owner, and runbook template.
3. Act
Create incident/task and capture acknowledgement latency.

Citations

References are listed with persistent DOI links. Use these IDs in implementation reviews and threshold design docs.

Ready to operationalize this detection model?

Start with one watchlist, one endpoint, and explicit monitor/notify/act tiers. Then refine thresholds from observed precision and recall.