There are distinct patterns in the text, speech, videos, and images used in internet-based broadcast and social media that give important clues about how people think about themselves and others, and why they are motivated to act out against a person or organization perceived as a threat. These patterns are often present weeks to months before more obvious physical activities occur, and thus can be informative in making forecasts about impending events. The ability to identify leading indicators can be especially valuable in anticipating gray zone activities, which are aggressive and coercive in nature, but fall below the intensity level of conventional military conflict. To address this challenge, we are developing WINSTON (Warnings and Indicators from Net-like distributed Signatures of Threats in Open communications and News media) -- a novel computational framework for using open source data to explore a gray zone of interest. WINSTON features (1) semi-automated profiling of relevant organizations/individuals and their threat intentions, tactics, and threat types; (2) semi-automatic extraction, association, and analysis of data from multiple channels to detect and monitor emergent threats; and (3) detection of weeks-to-months-prior leading indicators of signature hostility patterns.