All I can offer is: My analogy of following every ripple in the river holds firm. We're working with a puzzle with 10,000 pieces, and every eyeball helps - a little.
Several alert notices are still in place, even though we went back to Yellow from Orange. Some key infrastructure assets are still under Orange, as well.
Does everybody understand what I say, when I refer to "threat streams"? It's kind of like following a post, with all the replies to that post. Every bit of data has an origin, and all that's needed is to trace the stream back to the place of origin. And there are numerous threat streams out there:
WMD/Iraq/al-Qaeda; AQ cells/Yemen/Somalia; Jihadi transit across Syria; and more.
What most people are tracking is the CONUS threat, and it's admirable how many are using deductive reasoning. Keep GOING!