Well the rules don't spell out tactics for IC because that's too constraining for the GM.. a module might say what tactics the NPC security guards will use, but you wouldn't want the actual rules to say how security guards behave (except in very very broad strokes). Same thing for cybernetic security in the form of IC. Its exact actions on how it attempts to find intruders should be contextual rather than rules-dictated.
So the chart in DT. It makes more sense to me to look at it as the chart used for when the PC is not running silent. E.G. he's got his mark on the host and counting on the security to just assume he's yet another legit user because that's what he appears to be. As discussed in the
thread similar to this one the actual information the Patrol IC gathers on its perception test is what was the matrix action you last performed. If it was an illegal action... then whoops! Alarm bells sound.
The chart makes less sense to me in a context where the PC is running silent. It only takes 1 hit to learn that there is indeed a silent running icon inside the host, which will be the very first time the Patrol IC makes the perception test (Any Host worth giving stats to will have ratings sufficient to Buy at least 1 hit for the Patrol IC). At that point, it doesn't make sense for the Patrol IC to only search for hidden icons every X turns as per the chart suggestions. So again making the meatbody security NPC analogue... use GM discretion to decide what happens when the Patrol IC realizes there's a hacker afoot but hasn't yet "locked on" and spotted it. My assumption is it'd attempt to find that hidden icon for some number of turns in a row, and then if it hasn't located the hacker it sends an alert to the metahuman security spider to check out a possible anomaly, at which point the Patrol IC starts an entirely new cycle of scanning. Of course just as NPC security guards may assume an alert for attention from a remote sensor may just be the wind again, a security spider just might in your judgement also cancel a request for investigation from Patrol IC if it's been glitchy lately.
As for the Matrix Hide action working like Physical World Stealth: yeah, can't work the same way because the matrix doesn't work the same way as the real world. Icons have sculpting rules, and Personae just don't look like Files or Devices. You can't hide amongst them (although with the Wrapper program running, you can attempt a Matrix version of Disguise I suppose). As for "mind wiping" the Patrol IC into forgetting that you're the enemy... I'd highly suggest reading the thread I linked, especially firebug's comments. It doesn't appear that it is (or should be) possible as a rule of thumb. If you're dead set on the idea being possible, I suppose what the hacker would have to do is 1) find the Host's security logs, 2) crack the file protection on those logs, and then 3) edit the logs from a few seconds ago to omit ever having recognized your icon as a threat.
