6hr is probably a sensible cut off which will exclude short-term artefacts but will not miss a gradually rising trend due to spreading contamination etc. Maybe it would be possible to implement a moving average function which could trigger an alarm if an agreed threshold or a given rate of increase is acheived from more than 1 adjacent stations.

There is another kind of phenomenon which I am interested in (not accident related) which could be flagged by an alarm and that is brief but very large positive excursions in count rate at multiple stations caused by CME or even GRBs. It would be neat if we could capture these events as they happen.