Provides methods, systems and apparatus for generating alerts for a system process that obtains raw channel data over time from one or more monitored channel of the system process. An example method includes processing the raw channel data to form time dependent signals based one or more user specified processing rules. The method produces alerts based on the deviation in behavior in one or more channels, where the deviation is quantified by a numeric level computed by comparing signals for varying time intervals with historically normal baseline signals. The method may include filtering the alerts to selectively form reportable alerts that are presented to the user based on user specified filtering rules.