A diagnostic signal is any observable clue that helps explain how a system or device is behaving. In cyber security, that clue can be a log entry, an alert, a timing pattern, a network packet, a sensor reading, or even an unusual hardware noise. The value of a diagnostic signal is not that it proves a cause by itself, but that it narrows the possibilities and points investigators toward the right component, process, or layer.
Diagnostic signals matter because attacks often try to hide themselves, while defenders try to notice small deviations from normal behavior. A failed login burst, a new outbound connection, a changed boot message, or a repeated hardware buzz can all become useful evidence when compared with expected behavior. Analysts use these signals to separate noise from real incidents, confirm whether a problem is repeatable, and decide what to inspect next. In practice, strong detection depends on collecting the right signals and interpreting them carefully.