> ## Documentation Index
> Fetch the complete documentation index at: https://panaptico.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Signals: Turn Telemetry into Scored Business Meaning

> Signals transform raw telemetry into business meaning like 'risky user' or 'unmanaged device', scored continuously against thresholds with full drift and recovery history.

Signals are Panaptico's mechanism for turning raw telemetry into business meaning. A Signal answers questions like "Is this device unmanaged?" or "Is backup coverage below our safety margin?" Each Signal is scored continuously against a user-declared threshold, and every drift and recovery is recorded with full history. Signals are the bridge between sensor reads and operational judgment.

## How Signals work

A Signal starts with a data source: a System Sensor read, a log stream, a metric, or an event. You define the logic that maps raw values to a business state, then set the threshold that separates acceptable from unacceptable. Panaptico evaluates the Signal on every poll and records the result, the score, and the timestamp.

Because the history is complete, you can see not just the current state but when a Signal drifted, how long it stayed off target, and when it recovered. This decay and drift history is essential for audit and for understanding whether a fix was durable.

## Enriched Signals

Individual Signals answer single questions. Enriched Signals compose multiple Signals into entity-level judgment. For example, an Enriched Signal for a user might combine:

* A login risk Signal from Okta
* A device compliance Signal from Intune
* A network location Signal from Cloudflare

The result is a single judgment: "This operator is high-risk from an unmanaged device in an untrusted location." Enriched Signals make complex, cross-system states readable and actionable.

## Example: Backup safety margin

You define a Signal that counts daily successful backups across your production databases. The threshold is "at least 95% of databases backed up in the last 24 hours." On Tuesday the sensor reads show 92%. The Signal drifts to **off target** and Panaptico records the gap. On Wednesday the count returns to 97%. The Signal recovers to **at target**, and the full history shows the two-hour window of exposure.

## When to use Signals

Use Signals when you need continuous, scored judgment on telemetry that matters to the business. They are the building blocks for Initiatives, Routing rules, and Work Items.

<CardGroup>
  <Card title="System Sensor" icon="satellite-dish" href="/docs/docs/platform/system-sensor">
    The always-on readers that feed raw telemetry into Signals.
  </Card>

  <Card title="Initiatives" icon="bullseye" href="/docs/docs/platform/initiatives">
    Group Signals into budget-level programs with gap analysis and closed work loops.
  </Card>

  <Card title="Routing" icon="route" href="/docs/docs/platform/routing">
    Route actions automatically when Signals drift off target.
  </Card>
</CardGroup>
