[Stainless Steel Devil Rat]

Ran my first full-on hacker run on a corp facility last night and started to have a problem with Patrol IC.

The hacker has to have a mark to even enter the Host, and once he's got a mark (however fraudulently obtained) he's 'legit' in the eyes of the host and IC.   What is the Patrol IC supposed to ever 'see'?

In my example, the hacker looped camera footage & motion sensor (negative) detections so that the meatbody guards at the security station wouldn't see the team's spec ops infiltrator sneaking about.  I figured since all the Patrol IC ever does, every pass, is roll Matrix Perception, I figured once it eventually got to 4 hits on a single roll it'd notice that anomaly and prompt the security guards if 'they're sure' they want the cameras to be looping rather than showing live feeds.

From there, I figured I'd up the threshold for the Patrol IC to 5 before it'd randomly inspect the hacker's icon 'by chance'.  Eventually it made the roll, then on its next pass I had it roll matrix perception specifically on the hacker.  Ended up with 4 net hits, and I picked the 4 most unnerving (for the Hacker) things the Patrol IC will 'ask the GM'.  Among other things, it learned the hacker's commcode and most recent matrix action (which was naughty but successfully accomplished), which I decided was finally enough to trigger the Host into spawning more IC.

Is there a better template for handling Patrol IC that I missed, or is it fundamentally just GMs call on when the Host 'knows' it is under attack via Patrol IC?

[Kincaid]

There are a lot of schools of thought on this one--there isn't any official answers and I suspect it comes down to how hard you want to make Matrix runs.  I've gone back on forth on how I handle it.  Right now, I'm ruling that if you have a mark (and presumably you do if you're inside a host), you're fine until you perform either an Attack or Sleaze action, at which point the Patrol IC gets a chance to spot you.  The Patrol IC will then run a search cycle (which is essentially 2 Combat Turns of Matrix Perception checks--once a decker declares an Attack or Sleaze action, we're in initiative).  Performing more illegal actions starts the cycle anew.

Really, you can come up with whatever you think is plausible for a certain host to have, just make sure your players understand the basics of how you're running the Matrix so they make informed decisions.

[Bach_The_Fox]

There's been a couple of threads on this topic so far.

For my game, it depends on the Host.

A high volume host (lots of Personas logging in and out) Patrol IC is likely solely searching for hiding icons until someone does something illegal (succeeds with a Attack of fails a Sleaze).

Low volume Hosts (high security host that rarely has many personas active at one time) would likely scan every incoming persona for Matrix stats (sleaze/attack) and last action, possibly alerting the Security Spider if he finds someone with Sleaze/Attack, while also searching for silent icons every other action.

[Michael Chandra]

It kinda sounds like a Patrol IC is always performing Matrix Perception to gather intel, and shares that with the host. I'd imagine a host gets suspicious when an icon suddenly has more marks than before.