Add state tracking for real-time monitoring

[jinksunk]

Implement a state machine (attack graph, perhaps?) to track observed signals as they build toward an alert.