Screen every day. Open a case the day it fires.

Each day the warranty stream is screened across every factor with the same multiple-testing bar the investigation uses. The screen only says something is concentrating; when it fires, a full investigation opens on the data exactly as it stood that day, and decides whether it is a cause or a confounder.