At what point does an anomaly become a signal worth alerting on?

WORLD SIGNAL correlates changes across internet activity, aviation, infrastructure and external reporting. I’m curious where users would draw the line between “interesting anomaly” and “actionable event.”