The rulebook does not specify exactly how to run Patrol IC behavior is supposed to work.
I came up with a system (with help from the people at shadowruntabletop.com) that integrates your Overwatch Score into the host's "security level". It also defines what the Patrol IC does.
Here is a sample host, but host behavior may vary (differing OS thresholds, Patrol IC check frequency, etc.).
OS 0-9
OS 10-29 Go to Yellow Alert (if at Green)
OS 30+ Go to Red Alert
- Green Alert (normal operation)
- Patrol IC doesn't scan for silent icons
- Patrol IC investigates first illegal action per turn
- Patrol IC monitors for custom condition (e.g. checking a special file for marks) once a turn
- If alarm raised, launches Level 1 IC
- Yellow Alert (cautious operation)
- System decker alerted
- Patrol IC scans for silent icons once per turn, but does not launch IC unless an illegal action is committed
- Patrol IC investigates first illegal action per turn
- Patrol IC monitors for custom behavior (e.g. checking a special file for marks) every pass
- If alarm raised, launches Level 1|2 IC
- Red Alert (high threat response mode)
- System decker alerted
- Patrol IC scans for silent icons every pass and immediately launches IC if spotted
- Patrol IC investigates first illegal action per pass
- Patrol IC monitors for custom behavior (e.g. checking a special file for marks) every pass
- If alarm raised, launches Level 1|2|3 IC
- (Optional host behavior such as archiving files or rebooting)
- Patrol IC
- Launches IC if a spotted icon ("loud" or "silent" but already spotted) performs an illegal action
- No initiative needs to be rolled until Yellow Alert
- Level 1 IC
- Acid (Firewall)
- Binder (Data Processing)
- Jammer (Attack)
- Marker (Sleaze)
- Crash (crashes a program)
- Track
- Killer (Matrix damage)
- Level 2 IC
- Blaster (matrix + stun damage, linklock)
- Scramble (reboots you)
- Tar Baby (linklock + mark)
- Level 3 IC
- Sparky(matix + biofeedback damage)
- Black IC (matix + biofeedback damage, linklock)