{"scenario_id":"cyber-us-infrastructure","name":"Major cyber event on US infrastructure","evaluated_at":"2026-11-06T00:00:00.000Z","lit":1,"not_lit":1,"not_evaluated":4,"total":6,"modules":{"mayday":{"lit":0,"total":1},"sky":{"lit":0,"total":0},"money":{"lit":0,"total":0},"pulse":{"lit":1,"total":2},"homeland":{"lit":0,"total":3}},"modules_lit":["pulse"],"counted":false,"weight_lit":1,"weight_total":6,"lr_product":1,"elevated_at":3,"mayday_at":5,"reaches":"NORMAL","contribution":"NORMAL","why":"1 of 6 signs lit, from 1 module. 4 not evaluated.","gaps":["Incidents not yet disclosed.","Classified attribution.","Private network telemetry.","Cloudflare Radar data until an editor marks it.","Far more actively exploited flaws than normal added to CISA's list: still learning what normal looks like.","Far more US ransomware victims posted than normal: still learning what normal looks like.","Cloudflare reports an outage or an attack spike in a US region: needs an editor. No mark yet.","Food places near Fort Meade are at MAYDAY: not enough data in the last hour."],"signs":[{"sign_id":"cisa_emergency_directive","scenario_id":"cyber-us-infrastructure","words":"New CISA emergency directive","plain":"CISA gives federal agencies an emergency order about a threat","module":"homeland","kind":"event","state":"NOT LIT","confidence":"MODERATE","confidence_reason":"One source graded B2 or better.","why":"None in the last week.","weight":1,"evaluated_at":"2026-11-06T00:00:00.000Z","fetched_at":"2026-11-05T23:10:29.074Z","findings":[],"inputs":[{"type":"source_run","source":"cisa_advisories","status":"ok","last_ok_at":"2026-11-05T23:10:38.655Z","source_url":"https://www.cisa.gov/cybersecurity-advisories/all.xml","fetched_at":"2026-11-05T23:10:29.074Z","raw_key":"raw/cisa_advisories/2026/11/05/231029Z-e4ee191d5b2e.xml"}]},{"sign_id":"kev_over_baseline","scenario_id":"cyber-us-infrastructure","words":"KEV adds over baseline","plain":"Far more actively exploited flaws than normal added to CISA's list","module":"homeland","kind":"metric","state":"NOT EVALUATED","confidence":"LOW","confidence_reason":"No data to judge.","why":"Still learning what normal looks like.","weight":1,"evaluated_at":"2026-11-06T00:00:00.000Z","fetched_at":"2026-11-05T04:05:29.074Z","findings":[{"key":"US","label":"Flaws added to CISA's list","measure":"z","value":null,"bar":null,"lit":false,"ts":null}],"inputs":[{"type":"reading","db":"core","metric":"kev_adds","key":"US","ts":"2026-11-04T00:00:00.000Z","value":1,"z":null,"baseline":{"n":14,"mean":0.9960760646978732,"median":1,"mad":1,"method":"poisson_v1"},"source":"cisa_kev","source_url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","fetched_at":"2026-11-05T04:05:29.074Z","raw_key":"raw/cisa_kev/2026/11/05/040529Z-273b7e449828.json"}]},{"sign_id":"ransomware_us_over_baseline","scenario_id":"cyber-us-infrastructure","words":"ransomware.live US victims over baseline","plain":"Far more US ransomware victims posted than normal","module":"homeland","kind":"metric","state":"NOT EVALUATED","confidence":"LOW","confidence_reason":"No data to judge.","why":"Still learning what normal looks like.","weight":1,"evaluated_at":"2026-11-06T00:00:00.000Z","fetched_at":"2026-11-05T23:20:29.074Z","findings":[{"key":"US","label":"US ransomware victims","measure":"z","value":null,"bar":null,"lit":false,"ts":null}],"inputs":[{"type":"reading","db":"core","metric":"ransomware_victims","key":"US","ts":"2026-11-05T00:00:00.000Z","value":3,"z":null,"baseline":{"n":3,"mean":12.60041602421522,"median":16,"mad":6,"method":"poisson_v1"},"source":"ransomware_live","source_url":"https://api.ransomware.live/recentvictims","fetched_at":"2026-11-05T23:20:29.074Z","raw_key":"raw/ransomware_live/2026/11/05/232029Z-adefa6d69fb6.json"}]},{"sign_id":"radar_us_anomaly","scenario_id":"cyber-us-infrastructure","words":"Cloudflare Radar outage or attack anomaly for a US region","plain":"Cloudflare reports an outage or an attack spike in a US region","module":"pulse","kind":"editor","state":"NOT EVALUATED","confidence":"LOW","confidence_reason":"No data to judge.","why":"Needs an editor. No mark yet.","weight":1,"evaluated_at":"2026-11-06T00:00:00.000Z","fetched_at":null,"findings":[],"inputs":[]},{"sign_id":"ioda_us_state_outage","scenario_id":"cyber-us-infrastructure","words":"IODA internet outage in a US state","plain":"A large internet outage in a US state","module":"pulse","kind":"event","state":"LIT","confidence":"MODERATE","confidence_reason":"One source graded B2 or better.","why":"Seen 3 times in the last 24 hours.","weight":1,"evaluated_at":"2026-11-06T00:00:00.000Z","fetched_at":"2026-11-05T22:25:29.074Z","findings":[{"key":"01M6PV6VK00YZB5HRCRHCJWWGC","label":null,"measure":"event","value":null,"bar":null,"lit":true,"ts":"2026-11-05T21:53:00.000Z"},{"key":"01M6PSYJH0M9SQVK0MQDFN9CJ1","label":null,"measure":"event","value":null,"bar":null,"lit":true,"ts":"2026-11-05T21:31:00.000Z"},{"key":"01M6MPHK3099B2ATF0J4H9TFG9","label":null,"measure":"event","value":null,"bar":null,"lit":true,"ts":"2026-11-05T01:53:00.000Z"}],"inputs":[{"type":"event","id":"01M6PV6VK00YZB5HRCRHCJWWGC","source":"ioda","ts":"2026-11-05T21:53:00.000Z","tags":["ioda:critical","ioda:us_state"],"url":"https://ioda.inetintel.cc.gatech.edu/region/4414","source_url":"https://api.ioda.inetintel.cc.gatech.edu/v2/outages/alerts?from=1793907300&until=1793917529&entityType=region&limit=1000","fetched_at":"2026-11-05T22:25:29.074Z","raw_key":"raw/ioda/2026/11/05/222529Z-3f48baeb4d24.json"},{"type":"event","id":"01M6PSYJH0M9SQVK0MQDFN9CJ1","source":"ioda","ts":"2026-11-05T21:31:00.000Z","tags":["ioda:critical","ioda:us_state"],"url":"https://ioda.inetintel.cc.gatech.edu/region/4414","source_url":"https://api.ioda.inetintel.cc.gatech.edu/v2/outages/alerts?from=1793907300&until=1793917529&entityType=region&limit=1000","fetched_at":"2026-11-05T22:25:29.074Z","raw_key":"raw/ioda/2026/11/05/222529Z-3f48baeb4d24.json"},{"type":"event","id":"01M6MPHK3099B2ATF0J4H9TFG9","source":"ioda","ts":"2026-11-05T01:53:00.000Z","tags":["ioda:critical","ioda:us_state"],"url":"https://ioda.inetintel.cc.gatech.edu/region/4414","source_url":"https://api.ioda.inetintel.cc.gatech.edu/v2/outages/alerts?from=1793829329&until=1793850929&entityType=region&limit=1000","fetched_at":"2026-11-05T03:55:29.074Z","raw_key":"raw/ioda/2026/11/05/035529Z-b2c2f84dd8c8.json"}]},{"sign_id":"fort_meade_ring","scenario_id":"cyber-us-infrastructure","words":"Fort Meade ring MAYDAY","plain":"Food places near Fort Meade are at MAYDAY","module":"mayday","kind":"alert","state":"NOT EVALUATED","confidence":"LOW","confidence_reason":"No data to judge.","why":"Not enough data in the last hour.","weight":1,"evaluated_at":"2026-11-06T00:00:00.000Z","fetched_at":null,"findings":[],"inputs":[]}],"fetched_at":"2026-11-05T23:20:29.074Z","version":"3b1a3fe432503d54a232e13103417d21775036b9"}