# Question-to-signal worksheet

Blank worksheet. It records a proposed observation; it is not evidence that collection ran or a system was diagnosed.

- Symptom:
- Primary question:
- Decision this signal can change:
- Observation layer: now / host history / service behavior / longer-lived events
- Signal and unit:
- Scope/subject:
- Bounded aggregation dimensions:
- Correlation identifier, if required:
- Collection cadence:
- Required time window:
- Expected comparison or baseline:
- Retention period:
- Access owner:
- Export/deletion path:
- Alert condition, if any:
- Human action for the alert:
- Privacy/security review: Unreviewed
- Collection status: Not run
- Result: Not observed