A building can produce a steady stream of access activity, alarms, video changes, elevator conditions, visitor records, system-health data, support activity, and human observations. Most of that activity is routine. A much smaller share points to a condition someone needs to review.