How to tell a scheduled drill from a real activity surge

Every site with a garrison, a depot, or a test range runs some kind of exercise cycle. Vehicles stage, personnel muster, equipment gets pulled out and put back. If you've watched a site long enough, you've probably flagged a pass that looked alarming for about ten minutes before remembering it was the same week last quarter.

A single pass can't tell you which one you're looking at. You need the history.

What a recurring drill actually looks like across passes

A scheduled exercise has a shape to it, even before you know its date on the calendar. Vehicle count climbs over two or three days, holds for a window, then falls back to whatever that site normally runs at. Staging fills the same corners of the yard each time rather than spreading across the site. The recall rolls back almost as fast as the buildup happened, often inside a week. And the whole thing tends to recur on a cycle: same quarter, similar duration, same general footprint, year over year.

None of that shows up in one image. A single VHR pass of a motor pool sitting at 60% occupancy tells you occupancy is at 60%. It doesn't tell you whether that's day two of a routine readiness check or the start of something that isn't on anyone's training schedule. You only get the shape by stacking enough daily looks to see the rise, the hold, and the fall against what that site normally does.

Where a real surge breaks the pattern

Real-world surges tend to violate at least one part of the recurring shape, even when the raw vehicle count looks close to a known drill.

The buildup runs slower and doesn't taper on schedule. A drill recall is usually abrupt; a real surge often just keeps climbing, or holds at a level the site has never sat at before. Staging shows up in spots that haven't been used in prior cycles, because the dispersal is improvised instead of rehearsed. And the timing is off-cycle: a surge that lands eight weeks after the last recorded drill, instead of on the usual quarterly spacing, is doing something the training calendar doesn't explain.

None of these are certainties by themselves. A site can run an unscheduled drill. A real deployment can borrow a rehearsed staging plan. The comparison that matters is today's pass against what that specific site has done before, checked against its own history rather than a generic threshold for "a lot of trucks parked somewhere."

Treating every uptick the same way also burns through an imagery review queue fast. If every bump above baseline occupancy gets kicked upstairs regardless of whether it matches a known recurring pattern, the genuine deviations sit buried under routine exercises. A baseline built from repeat daily looks at the named site, not a library shot or a regional average, is what lets a pass get triaged as "matches the Q3 pattern" instead of waiting in a queue until someone with a long institutional memory happens to notice.

Carrying the baseline instead of holding it in your head

Most of this currently lives in an analyst's head, or in a notebook of past drill dates someone has to pull and check by hand. That works fine until the analyst rotates out, or until the site has run enough cycles that the pattern is hard to carry alongside everything else on the watch list.

Activity-Based Intel exists for that gap. It accumulates daily VHR observations of a named site into a normal-activity baseline, and checks each new pass against it, so a genuine deviation surfaces as a flagged anomaly instead of waiting for someone to notice it looks off.

If a site on your list runs an exercise cycle you've been tracking by hand, it's worth seeing what a running baseline does with it.