(This uses the conquest system; so read about that if "flags" doesn't make sense to you: http://detectmagic.blogspot.com/2014/03/conquest.html)
I'm thinking you can have separate tables for different ranges. One range for hard moves, the other for soft—one for warnings and another for the things warned of.
At simplest, a 1 on the check is a hard move; a 2 is a soft move.
FNPC = Flag-NPC = an NPC who herself represents influence or control in a realm.
Warnings
leave grisly message for the guild
show faction surveilling, tailing, casing, conferring with law enforcement or another faction
capture / kill associate
threaten a member, PC, or FNPC
show something weird and dangerous
threaten an NPC a PC cares about
show the FNPC floundering, falling off the wagon, being irresponsible, generally managing the flag and/or himself poorly
show a faction fighting to retake a flag, giving PCs chance to intervene
Crises
have factions ally against them
have the FNPC lose it: the flag is destroyed, nonproductive, or captured
burned, looted, poison, plague a flag
kill / capture a member / FNPC, meaning the flag is either taken out or captured by faction
gank a PC, with opportunity to fight back
capture / arrest a PC with no chance to fight back but give opportunity later to escape or make a deal; remember, factions always want something
manifest something weird and dangerous as a threat right now
turn someone traitor
harm / capture / kill an NPC a PC cares about
have a faction capture a flag
have an FNPC set them up
