P Nation said:2 or fewer is too much uncertainty for an action, 4 or more is too late for an action once a hostile scenario has presented itself, according to the FBIs behavioral science division which hosted a portion of a course I attended.
The wording of your post sort of negates your whole premise. You are talking about making observations that the sum of their parts would lead you to a conclusion that something is terribly wrong. 2 observations isn't enough to take any action(with no other information) but 4 observations AFTER THE HOSTILE SCENARIO presents itself is too late. 1 observation is too much AFTER THE SITUATION HAS ALREADY PRESENTED ITSELF.