No single feed tells you whether an event is safe. A weather alert alone misses the protest. A protest alone misses the wildfire smoke. SignalGuard fuses 50+ live signals across four pillars — Chatter, Environment, Movement, Context — scores each one against the same severity scale, and consolidates the picture for the people running the event.
This page is a plain-English tour of every signal grouped the same way they're grouped in the dashboard, the per-signal alert mute list on /notifications, and the executive PDF brief — so the taxonomy you learn here is the taxonomy you run the product against.
People talk about events before, during, and after they happen. Ten different platforms, ten different communities, ten different vantage points — from open-platform shouting to allowlist-curated channels and the global news cycle — plus a derived crowd-surge classifier that re-reads all of that chatter for the language of a developing crush. We pull from all of them so the read isn't dominated by any one platform's tone.
The fastest pulse. Threats, complaints, and on-the-ground reports surface here first. Each post is read by the AI classifier and tagged Critical, High, Medium, or Low — with a written reason you can challenge.
Why we use it: speed. By the time something hits the news, X has already been posting about it for an hour.
Long-form context. Local subreddits ("r/LasVegas", "r/Coachella") are where attendees vent about logistics, organize meetups, and post warnings. Threat-coded keywords are scored the same way as X posts.
Why we use it: depth. Reddit threads explain *why* something is happening, not just that it is.
Smaller user base, but disproportionately journalists, civic organizers, and infrastructure-watchers. Catches stories X misses or buries.
Why we use it: signal where the noise hasn't caught up yet.
Decentralized — many independent servers. Strong overlap with international and activist communities. Useful for events with cross-border attendance or political dimension.
Why we use it: it surfaces conversation that platforms with heavy moderation actively suppress.
Allowlisted public channels — protest coordination, resale rings, counter-demo callouts, and football-firm chatter. Channel set is operator-curated, not crawled.
Why we use it: the protest organizing that no longer lives on open platforms still lives here. Real-data path activates when a gateway is configured.
Short-form video chatter — flash-mob style mobilization, ticket-plug accounts, walkout planning. Severity weights views-per-hour velocity, not raw view count.
Why we use it: virality cycles here are 24–48h, fast enough to matter for event-day staffing. Real-data path activates when Research API credentials land.
Public posts and status threads from Truth Social, scored the same way as the other chatter feeds — mobilization language, named targets, and event-specific coordination — for an audience that doesn't overlap much with the mainstream platforms.
Why we use it: relevant chatter clusters on platforms the other feeds miss. Activates when a Truth Social access token is connected.
Video uploads about the venue, recent incidents, or recurring event franchises. Comment threads on those videos often contain protest plans, ticket-fraud warnings, and rumors that don't appear in text-only feeds.
Why we use it: a meaningful share of organizing happens in video comments now, not on text platforms.
A 24-hour-refreshed global news index that reads thousands of news outlets and flags articles mentioning protest, violence, terror, unrest, and security around the event, venue, or location. Tone-scored — a wave of negative coverage is itself a signal, even if no single headline is alarming.
Why we use it: the news cycle catches things social misses, and vice versa. Together they're stronger than either alone.
A dedicated threat-intelligence sweep across known extremist, resale, and coordination channels — distinct from the general Telegram chatter feed. Messages are scored for direct threats against the venue, artist, or event and ranked by how on-target they are.
Why we use it: the most specific threats rarely appear on open platforms. This is the layer that catches a named target before it moves anywhere else.
Tor-indexed hidden-service mentions of the venue, event, or artist, surfaced via the Ahmia index. Hits are de-duplicated by onion address and ranked by whether they're direct, on-target references versus passing mentions.
Why we use it: a venue or artist surfacing on a Tor index is a qualitatively different signal than a social post — it's worth knowing the moment it appears.
A derived classifier — no new feed. After the chatter sources resolve, every post is re-read for crowd-dynamics intent and distress: gate-rushes, oversell, ingress-crush, stage-surge, and the explicit distress language ("can't breathe," "people going down," "barrier's bending"). The strongest categories dominate the score, so one credible distress report outweighs a hundred routine hype posts.
Why we use it: in the Astroworld pattern the crowd is saying it is in trouble minutes before CCTV or control-room awareness catches up. This reads the chatter for that one dimension. It caps at High on its own and only corroborates to Critical alongside a crowd-density or other Tier-1 read — chatter alone never manufactures a crush.
Public Instagram posts tied to the event via its hashtags, with captions read by the same threat classifier as the other chatter sources. Scoped to each event's official hashtags (Instagram has no public keyword or location search), with promo- and giveaway-caption filtering so marketing noise doesn't register.
Why we use it: a huge share of attendees post from inside the event on Instagram — the captions surface crowd-density, weather, and access complaints that don't show up on text-first platforms. Activates once an Instagram Business token is connected.
What's happening in the physical environment around the venue — the forecast and active warnings, wind and gusts, lightning, heat stress and UV, air quality, severe-weather outlooks, active fires, recent ground motion, and how far the show's own noise carries to the neighbours. These don't lie and don't trend. When the environment is the threat, every other signal is downstream.
Authoritative US government forecast plus active warnings (heat, severe storms, flood, wildfire smoke, hurricane, tornado). Includes the day-of-event high/low, wind, and rain probability for the venue.
Why we use it: weather is the single most common reason outdoor events get delayed, modified, or cancelled.
Live US AQI plus per-pollutant readings (PM2.5, PM10, ozone, NO₂, SO₂, CO) and a 24-hour forecast. Covers wildfire smoke, ozone alerts, dust, and inversion smog — anything that makes the air harder to breathe.
Why we use it: weather can be sunny and pleasant while the AQI is in the red. For outdoor events the air is the event.
NOAA Storm Prediction Center categorical outlooks for today and tomorrow — checks whether the venue's location falls inside an SPC risk polygon (TSTM through HIGH risk for tornadoes, hail, and damaging wind).
Why we use it: weather alerts tell you what's happening *now*. SPC tells you what to plan around tomorrow.
Satellite-detected active fire hotspots within a configurable radius of the venue, with distance, fire radiative power, and detection confidence. Pairs with the Air Quality card — FIRMS sees the fire, AQI sees the smoke.
Why we use it: a 25-mile-distant wildfire isn't an evacuation problem, but it's a smoke problem. And smoke shuts down outdoor events at AQI 150+.
The authoritative "is there an official warning in effect HERE, right now" layer — tornado, severe-thunderstorm, flash-flood, extreme-heat, red-flag fire, and winter-storm watches and warnings issued for the venue's point. Severity tracks the worst active alert: Extreme reads Critical, Severe High, Moderate Medium.
Why we use it: the SPC outlook tells you the day-ahead probability and the forecast tells you conditions — this is the issued, in-effect warning that turns a watch into a decision.
Live wind and gust speed at the venue, scored against the thresholds outdoor events actually plan to: gusts of 25 mph read Medium (secure loose staging), 40 mph High (a common stage-evacuation / load-out trigger), and 58 mph Critical — the NWS severe-thunderstorm wind criterion.
Why we use it: gusts drive stage, rigging, tent, and video-wall integrity, pyro and drone go/no-go, and barrier risk. The 2011 Indiana State Fair stage collapse is the case every outdoor staged event plans around.
Real-time strike detection from the Blitzortung network, scored by the nearest strike in the last 30 minutes. It encodes the outdoor-event "30/30 rule": a strike within ~10 miles reads Critical (suspend-play range), within ~30 miles High, within ~50 miles Medium.
Why we use it: lightning is the most common reason an outdoor show pauses, and the call is time-critical. Distance-to-strike is the number the safety officer needs in front of them.
Wet Bulb Globe Temperature — the heat-stress index that factors humidity, wind, and solar load, not just air temperature. Pulled directly from the NWS forecast gridpoint where available, estimated from Open-Meteo elsewhere. Scored against the same work-rest thresholds the NCAA, US military, and OSHA use.
Why we use it: 95°F in dry shade and 88°F in humid full sun are very different medical-tent loads. WBGT is the number that drives activity, hydration, and cancellation calls — exactly the decision an event operator has to make.
Current UV index at the venue on the WHO global solar scale. A daytime crowd-health and duty-of-care read: 11+ (Extreme — burn in minutes) reads High, 6–10 (High / Very high) Medium, below that Low. A background-tier signal that informs posture but never drives it on its own.
Why we use it: high UV drives medical-tent load — sunburn and heat illness — and shade, water, and exposure messaging for crowd, staff, and performers.
A simplified ISO 9613-2 propagation model that predicts the show's A-weighted level at nearby noise-sensitive receptors — hospitals, care homes, schools, residential — pulled from OpenStreetMap, and flags exceedances of each type's limit. The wind term is live: sound carries downwind and is lost upwind, so which neighbours are exposed changes as the wind rotates, recomputed roughly every half hour.
Why we use it: offsite noise is the most common cause of a licence complaint and a next-year permit fight. This is a planning prediction, not a compliance measurement — it caps at High on its own and tells you which way to point the stage.
Seismic events from the last 7 days within range of the venue, with magnitude, depth, and distance. Severity escalates with both magnitude and proximity — a M5 quake 10 km away reads very differently from a M6 quake 200 km away.
Why we use it: structures, stages, and crowd-loaded venues respond to ground motion poorly. Worth flagging anything recent.
A land/vegetation fire-danger read for the venue — the Fosberg Fire Weather Index computed from temperature, humidity, and wind over the show window, escalated by any active NWS Red Flag Warning or Fire Weather Watch.
Why we use it: dry, windy conditions are the precondition for ignition and fast spread near outdoor and wildland-adjacent venues — the leading read before a wildfire actually starts.
Flood, flash-flood, and river-stage risk — active NWS flood products (warning → Critical, watch → High, advisory → Medium) plus the nearest USGS stream gauge with its current stage and rising/falling trend.
Why we use it: low-lying and riverside sites can flood ingress routes, campgrounds, and parking before the venue itself is at risk. The gauge trend gives lead time to move vehicles and people.
Wildfire-smoke transport and PM2.5 air-quality forecast over the show window — current and peak US AQI with the hour it crosses Unhealthy, so you see smoke arriving before it lands. Adds trajectory and lead time to the current-only Air quality signal.
Why we use it: smoke can turn a clear afternoon into an Unhealthy evening for a standing crowd. The forecast gives time to stage masks, shade, and medical before the AQI spikes.
A derived signal — no new feed. It converts the live Wind & gusts read into a per-structure operational margin against demountable-structure action levels: go, caution, reduce, or stop, with the headroom in mph against the configured limits for stages, rigging, screens, and temporary structures.
Why we use it: a raw gust number doesn't tell the stage manager what to do — the margin to the structure's action level does. Surfaces the go/reduce/stop call directly.
A derived go/caution/no-go window for pyrotechnics, naked flame, and special effects — combining the live wind, lightning, and fire-danger signals against their environmental limits. NO-GO on lightning in range, an active Red Flag, extreme fire danger, or gusts over the pyro wind limit.
Why we use it: pyro and SFX cues have hard environmental limits, and conditions can change between soundcheck and showtime — the real-time read the effects operator and safety officer share.
What's actually moving in the physical space around the venue — aircraft overhead, the drone airspace picture (no-fly zones, LAANC ceilings, stadium TFRs, and flight conditions), traffic on access roads, the health of the drive approaches, the egress terrain and how fast a crowd can clear, hostile-vehicle approach geometry, transit disruptions, flight restrictions and notices from the FAA, live emergency-services chatter, and cellular network health. These are the leading indicators that something has changed on the ground while the world was still posting about it. The count is of scored signals; the two drone map layers below are visualizations of the FAA drone source, not separate scored reads.
Live aircraft positions over the venue — helicopters circling, low-altitude overflights, aircraft squawking emergency codes, persistent loitering. We don't see consumer drones (those broadcast a different signal), but everything with a transponder shows up.
Why we use it: a media helicopter circling at 1,500 ft over a music festival is not a routine event. It's a signal that *something* just happened.
Active Temporary Flight Restrictions issued by the FAA near the venue. These get issued for VIP visits, protests, wildfires, hazards, and major sporting events. Often the first formal acknowledgement that an area is sensitive.
Why we use it: TFRs are leading indicators. When one appears near your venue, the FAA already knows something we should know too.
Notices to Airmen — the official FAA advisory layer that covers VIP movement notices (often issued BEFORE a TFR drops), drone / UAS activity, airshows, parachute ops, airspace restrictions, and runway closures. Every TFR is a NOTAM, but most NOTAMs aren't TFRs.
Why we use it: NOTAMs catch the planned-but-not-yet- restricted layer. A drone NOTAM for the same day as your event is the strongest early warning you get for airspace activity OpenSky won't show, and a VIP-movement NOTAM is your tip that a TFR is coming.
Live road incidents in a tight ring around the venue — accidents, road closures, jams, lane closures, road work, weather hazards. Filterable by category so you can isolate "just road closures" or "just accidents."
Why we use it: most event-day operational headaches are traffic problems before they're security problems. A closure on the only access road affects every person trying to get in and every emergency vehicle trying to get out.
Public police / fire / EMS scanner feeds for the venue's county, sourced from Broadcastify. By default the card surfaces a click-through to the county feed listing — with an API key it enriches to a live feed list with listener counts.
Why we use it: real-time radio chatter is 20-40 minutes ahead of GDELT news and X. SignalGuard does not stream, cache, or transcribe audio — when you click a feed, playback happens on Broadcastify's hosted player. We surface the pointer; the human analyst listens.
Carrier coverage and network technology (5G / LTE / rural) at the venue coordinates. A weak or congestion-prone cell environment is an operational risk in its own right — radios, payment terminals, and incident-reporting apps all degrade when the network does.
Why we use it: 60,000 phones arriving at once can saturate a cell site. Knowing the baseline tells you whether to expect a comms problem before the doors open.
Hostile-vehicle-mitigation mapping — the vehicle-as-weapon read on your perimeter. We derive a set of crowd points from the venue footprint, pull the drivable road network from OpenStreetMap, and for every approach compute three things: standoff distance to the crowd, the longest straight acceleration run, and the achievable impact speed. Each approach gets its own severity; a closure or barrier within the access point neutralises it.
Why we use it: this is geometry-based vulnerability mapping, not attack detection — it shows you where a vehicle could build speed into a crowd before doors, when you can still move a barrier. It caps at High on its own and reaches Critical only when corroborated by a Tier-1 threat in another pillar (e.g. an elevated NTAS), so a single open road never manufactures a permanent red.
Drive-time isochrones around the venue — the 5/10/15-minute reachable-area contours from the road network. We read the 10-minute area as a planning proxy for egress constraint: a small reachable area means roads choke the dispersal (water, mountains, a single arterial), a large one means the crowd can clear quickly in many directions.
Why we use it: how fast a crowd can leave is half the safety picture, and it's a property of the geography, not the night. This is a planning read — it informs the egress plan and caps at Medium, so it never drives overall posture on its own.
Traffic-aware health of the drive approaches into and out of the venue. Where the Traffic signal reads point-incidents, this samples the four cardinal approaches ~6 km out, routes each into the venue with live traffic, and compares the live drive time and per-segment congestion against free-flow. The worst of the four approaches sets the band.
Why we use it: an accident might clear, but a chronically congested or closed approach reshapes ingress and egress for the whole event. A planning read — it caps at Medium and informs the plan rather than driving posture.
The physical egress terrain immediately around the venue — nearby water and rail barriers (chokepoints) and the surrounding road mix, through-arteries versus embedded service and lot roads. A static planning read: if you had to clear this venue, what does the ground around it look like?
Why we use it: a venue boxed in by a river on one side and a rail line on another has fundamentally fewer ways out than an open suburban site. Geography that pre-existed the event and shapes every evacuation plan. Caps at Medium — a planning read, not a posture driver.
Public-transit service disruptions near the venue — rail, subway, and bus suspensions, delays, and detours — read from agency GTFS-Realtime service-alert feeds where the venue falls inside a covered metro. Severity tracks the effect: a full line suspension reads higher than a minor delay.
Why we use it: most stadium crowds arrive by transit, so a line suspension at kickoff is a first-order ingress and egress problem that road traffic alone can't see.
How open the sky over the venue is to a drone, scored from the FAA no-fly zones and LAANC ceiling grid: OPEN SKY (drones legal to 400 ft), a capped ceiling, or PROTECTED (no-fly / 0 ft overhead). The single read on counter-drone exposure.
Why we use it: consumer drones don't broadcast on ADS-B, so OpenSky can't see them. The airspace rules tell you how exposed you are before one ever launches.
Whether a federal stadium Temporary Flight Restriction is in effect — the standing 14 CFR §99.7 ban on UAS within 3 nm and below 3,000 ft during major-league (NFL / MLB / NCAA / NASCAR) games. Matched by venue and league.
Why we use it: when the ban is active, any drone overhead is a federal violation — which changes both the threat read and the law-enforcement response available to you.
Whether a drone can physically fly over the venue right now — FLYABLE, MARGINAL, or GROUNDED — derived from live wind, gusts, precipitation, and visibility. Favorable weather enables drone ops; high wind or rain suppresses the threat.
Why we use it: the airspace can be wide open and still effectively closed by a 30 mph gust. Conditions tell you whether the drone threat is live or weather-grounded.
The FAA's drone no-fly polygons near the venue — national security areas, prohibited zones, and special-use airspace where UAS are banned outright. Rendered as a toggleable layer on the map and flagged when the venue falls inside one.
Why we use it: a venue sitting inside a no-fly zone has a completely different drone posture than one in open airspace. This is the geographic ground truth.
The FAA UAS Facility Map — the LAANC ceiling grid that sets how high a drone may legally fly in each cell of controlled airspace, from 0 ft (no authorization) up to 400 ft. A toggleable map layer; the venue's containing cell drives the drone-airspace score.
Why we use it: "controlled airspace" isn't binary. A 200 ft ceiling still allows a drone to operate well above crowd height — the grid tells you exactly how much room there is.
The backdrop the rest of the signals get read against — federal advisories, baseline crime, active disaster declarations, grid and power status, how fast emergency services can reach you, and what else is happening around the venue commercially. Same chatter, same airspace, same weather reads differently in front of a different backdrop.
The current advisory from the Department of Homeland Security's National Terrorism Advisory System — the modern successor to the old color-coded threat level. Three tiers: Bulletin (informational), Elevated Alert, Imminent Alert. Most of the year there's no active advisory; when one is in effect we surface it as a banner above every brief.
Why we use it: when DHS issues an advisory, every event in the country needs to know. National in scope, but never national in attention until it appears.
The State Department's country travel advisory level (1–4) for the event's country, with the underlying advisory text. For international events it's a baseline read on the operating environment; when an advisory is active we surface it as a banner beneath the NTAS bulletin on the brief.
Why we use it: a Level 3 "Reconsider Travel" backdrop changes how every other signal should be read — and it's the kind of context a US-centric security team can easily miss for an overseas show.
Annual violent and property crime rates for the venue's city compared to the national average. Not a real-time signal — a backdrop. Tells you whether you're operating in a low- or high-risk environment by default.
Why we use it: same chatter reads differently in a sleepy suburb vs. a high-crime metro. This is the calibration.
Federally-declared disasters currently in effect for the venue's state — Major Disaster, Emergency, and Fire Management Assistance declarations. Authoritative, county-deduplicated, and grouped by incident.
Why we use it: when FEMA has declared something, the operational picture has already changed. Resource deployments, mass-care activations, evacuation routes — all of it stems from this list.
Counter-event detection — every ticketed concert, sports game, theater show, or family event within 10 miles of the venue in the days around your event. Includes sold-out status, venue capacity tier (large / medium / small), distance, and same-day overlap flag.
Why we use it: a sold-out 18K-capacity NBA game two blocks away on the same night completely reshapes ingress, transit, and adjacent-area policing demand. None of the other signals see that — Ticketmaster does.
Points of interest within 500 m of the venue — bars, clubs, transit hubs, hotels, hospitals, police precincts, adjacent crowd magnets. Categorized so you can read crowd flow at a glance: lots of bars within 300 m = pre-event drinking cluster; transit hub within 200 m = ingress chokepoint.
Why we use it: severity here isn't threat, it's operational complexity. A venue in a dense bar district with a major transit station next door demands a different staffing plan than a suburban arena. The POI map tells you which one you're walking into.
How fast help can arrive. We find the nearest hospital, police station, and fire station around the venue and compute each one's free-flow drive ETA to the gate. A nearest hospital beyond 15 minutes reads High; the nearest PD or fire beyond 10 minutes reads Medium — the planning answer to "if something goes wrong, how long until help is here?"
Why we use it: the same incident is a different plan when the nearest trauma centre is four minutes away versus twenty-two. A planning read, not a live posture driver — it caps at Medium and reports the true ETA so you can staff to it.
Electrical-grid and utility outages near the venue — customers out, by county and utility, within range of the site. The source is provider-pluggable: a commercial county-granularity feed or free utility outage layers drop in by configuration, no code change. Until a source is wired for a deployment the card reports honestly as out of coverage rather than a false all-clear.
Why we use it: power loss is a named major-incident hazard — it takes lighting, comms, payment, and life-safety systems with it.
The receiving-hospital picture for the venue — nearest emergency departments with their trauma-center level and capability, the backbone of a casualty plan. Confirms where casualties actually go before an incident, not during one.
Why we use it: a medical plan that hasn't confirmed its receiving hospitals is a plan on paper.
Region-level internet backbone health — major CDN, cloud, and BGP-routing status near the venue, drawn from public provider status pages and internet-outage observatories. A region-scale read, not a venue-specific one.
Why we use it: comms, ticketing, payment, and access-control all ride on the public internet — a regional outage degrades them at once.
A predictive read on how hard the electric grid serving the venue is working — demand versus the day-ahead forecast and the recent peak for the venue's balancing authority (EIA Grid Monitor). Distinct from the Power outages signal: the leading indicator of strain before a brownout, not a realized outage.
Why we use it: tight reserve margins and demand over forecast precede rolling blackouts — time to confirm generators and load-shed priorities before the operator declares an emergency. Activates when an EIA API key is connected.
The 50+ signals above are raw data — what's true, where, and how recently. Two AI-generated panels sit on top of them and do something the data alone can't: tell you the story across the sources, and what to do about it. Both are produced in a single Claude Haiku 4.5 call after the scan finishes. The model sees a compacted version of every signal at once, with its severity scores and key metrics.
A 3–4 sentence narrative that reads all 50+ signals together and explains what's actually happening. It identifies the genuine concerns, the false alarms, and the connections between sources — for example, the active FEMA fire declaration plus a forecast wind shift plus a current AQI reading combining into one operational risk. Sits at the top of every brief and as the lead block on the PDF cover.
Why it matters: 40+ facts on a page is not a story. The synthesis is the story.
Two to four concrete next steps, each starting with a verb and referencing specific data from the brief. On a quiet day this collapses to a single line: "Continue routine monitoring; no action required." On a busy day it's a checklist a security lead can hand to the team. Sits below the Mastodon card on the FE and at the top of the Intelligence Summary section in the PDF.
Why it matters: a brief that doesn't end with "do this next" is a passive read. This makes it operational.
The model sees a compact summary (severity scores, headline metrics, top items per source) — not the full payload. It is asked to use only the data given and never to invent specifics. If the AI service is unavailable or the API key is missing, both panels degrade silently — the rest of the brief still renders fine.
Any one of these signals lies if you read it alone. Social chatter is noisy. Crime baseline is stale. Weather can be a quiet day on a high-tension week. News lags. Aircraft circle for ordinary reasons. A single TFR could be a routine presidential-visit notice with no bearing on your event.
Together, they triangulate. Three of these flagging at the same time is a real signal. One flagging is something to watch. None flagging is what an actual quiet day looks like — and knowing the difference is the whole point.
Each scan rolls all 50+ signals into a single overall score, alongside the per-source detail so you can see exactly what's driving the number. If you disagree with the call, the reasoning is on the page; you can override it on the spot.