Payload
JSON, PRETTY-PRINTED{
"scenario_id": "cyber-us-infrastructure",
"name": "Major cyber event on US infrastructure",
"evaluated_at": "2026-11-06T00:00:00.000Z",
"lit": 1,
"not_lit": 1,
"not_evaluated": 4,
"total": 6,
"modules": {
"mayday": {
"lit": 0,
"total": 1
},
"sky": {
"lit": 0,
"total": 0
},
"money": {
"lit": 0,
"total": 0
},
"pulse": {
"lit": 1,
"total": 2
},
"homeland": {
"lit": 0,
"total": 3
}
},
"modules_lit": [
"pulse"
],
"counted": false,
"weight_lit": 1,
"weight_total": 6,
"lr_product": 1,
"elevated_at": 3,
"mayday_at": 5,
"reaches": "NORMAL",
"contribution": "NORMAL",
"why": "1 of 6 signs lit, from 1 module. 4 not evaluated.",
"gaps": [
"Incidents not yet disclosed.",
"Classified attribution.",
"Private network telemetry.",
"Cloudflare Radar data until an editor marks it.",
"Far more actively exploited flaws than normal added to CISA's list: still learning what normal looks like.",
"Far more US ransomware victims posted than normal: still learning what normal looks like.",
"Cloudflare reports an outage or an attack spike in a US region: needs an editor. No mark yet.",
"Food places near Fort Meade are at MAYDAY: not enough data in the last hour."
],
"signs": [
{
"sign_id": "cisa_emergency_directive",
"scenario_id": "cyber-us-infrastructure",
"words": "New CISA emergency directive",
"plain": "CISA gives federal agencies an emergency order about a threat",
"module": "homeland",
"kind": "event",
"state": "NOT LIT",
"confidence": "MODERATE",
"confidence_reason": "One source graded B2 or better.",
"why": "None in the last week.",
"weight": 1,
"evaluated_at": "2026-11-06T00:00:00.000Z",
"fetched_at": "2026-11-05T23:10:29.074Z",
"findings": [],
"inputs": [
{
"type": "source_run",
"source": "cisa_advisories",
"status": "ok",
"last_ok_at": "2026-11-05T23:10:38.655Z",
"source_url": "https://www.cisa.gov/cybersecurity-advisories/all.xml",
"fetched_at": "2026-11-05T23:10:29.074Z",
"raw_key": "raw/cisa_advisories/2026/11/05/231029Z-e4ee191d5b2e.xml"
}
]
},
{
"sign_id": "kev_over_baseline",
"scenario_id": "cyber-us-infrastructure",
"words": "KEV adds over baseline",
"plain": "Far more actively exploited flaws than normal added to CISA's list",
"module": "homeland",
"kind": "metric",
"state": "NOT EVALUATED",
"confidence": "LOW",
"confidence_reason": "No data to judge.",
"why": "Still learning what normal looks like.",
"weight": 1,
"evaluated_at": "2026-11-06T00:00:00.000Z",
"fetched_at": "2026-11-05T04:05:29.074Z",
"findings": [
{
"key": "US",
"label": "Flaws added to CISA's list",
"measure": "z",
"value": null,
"bar": null,
"lit": false,
"ts": null
}
],
"inputs": [
{
"type": "reading",
"db": "core",
"metric": "kev_adds",
"key": "US",
"ts": "2026-11-04T00:00:00.000Z",
"value": 1,
"z": null,
"baseline": {
"n": 14,
"mean": 0.9960760646978732,
"median": 1,
"mad": 1,
"method": "poisson_v1"
},
"source": "cisa_kev",
"source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
"fetched_at": "2026-11-05T04:05:29.074Z",
"raw_key": "raw/cisa_kev/2026/11/05/040529Z-273b7e449828.json"
}
]
},
{
"sign_id": "ransomware_us_over_baseline",
"scenario_id": "cyber-us-infrastructure",
"words": "ransomware.live US victims over baseline",
"plain": "Far more US ransomware victims posted than normal",
"module": "homeland",
"kind": "metric",
"state": "NOT EVALUATED",
"confidence": "LOW",
"confidence_reason": "No data to judge.",
"why": "Still learning what normal looks like.",
"weight": 1,
"evaluated_at": "2026-11-06T00:00:00.000Z",
"fetched_at": "2026-11-05T23:20:29.074Z",
"findings": [
{
"key": "US",
"label": "US ransomware victims",
"measure": "z",
"value": null,
"bar": null,
"lit": false,
"ts": null
}
],
"inputs": [
{
"type": "reading",
"db": "core",
"metric": "ransomware_victims",
"key": "US",
"ts": "2026-11-05T00:00:00.000Z",
"value": 3,
"z": null,
"baseline": {
"n": 3,
"mean": 12.60041602421522,
"median": 16,
"mad": 6,
"method": "poisson_v1"
},
"source": "ransomware_live",
"source_url": "https://api.ransomware.live/recentvictims",
"fetched_at": "2026-11-05T23:20:29.074Z",
"raw_key": "raw/ransomware_live/2026/11/05/232029Z-adefa6d69fb6.json"
}
]
},
{
"sign_id": "radar_us_anomaly",
"scenario_id": "cyber-us-infrastructure",
"words": "Cloudflare Radar outage or attack anomaly for a US region",
"plain": "Cloudflare reports an outage or an attack spike in a US region",
"module": "pulse",
"kind": "editor",
"state": "NOT EVALUATED",
"confidence": "LOW",
"confidence_reason": "No data to judge.",
"why": "Needs an editor. No mark yet.",
"weight": 1,
"evaluated_at": "2026-11-06T00:00:00.000Z",
"fetched_at": null,
"findings": [],
"inputs": []
},
{
"sign_id": "ioda_us_state_outage",
"scenario_id": "cyber-us-infrastructure",
"words": "IODA internet outage in a US state",
"plain": "A large internet outage in a US state",
"module": "pulse",
"kind": "event",
"state": "LIT",
"confidence": "MODERATE",
"confidence_reason": "One source graded B2 or better.",
"why": "Seen 3 times in the last 24 hours.",
"weight": 1,
"evaluated_at": "2026-11-06T00:00:00.000Z",
"fetched_at": "2026-11-05T22:25:29.074Z",
"findings": [
{
"key": "01M6PV6VK00YZB5HRCRHCJWWGC",
"label": null,
"measure": "event",
"value": null,
"bar": null,
"lit": true,
"ts": "2026-11-05T21:53:00.000Z"
},
{
"key": "01M6PSYJH0M9SQVK0MQDFN9CJ1",
"label": null,
"measure": "event",
"value": null,
"bar": null,
"lit": true,
"ts": "2026-11-05T21:31:00.000Z"
},
{
"key": "01M6MPHK3099B2ATF0J4H9TFG9",
"label": null,
"measure": "event",
"value": null,
"bar": null,
"lit": true,
"ts": "2026-11-05T01:53:00.000Z"
}
],
"inputs": [
{
"type": "event",
"id": "01M6PV6VK00YZB5HRCRHCJWWGC",
"source": "ioda",
"ts": "2026-11-05T21:53:00.000Z",
"tags": [
"ioda:critical",
"ioda:us_state"
],
"url": "https://ioda.inetintel.cc.gatech.edu/region/4414",
"source_url": "https://api.ioda.inetintel.cc.gatech.edu/v2/outages/alerts?from=1793907300&until=1793917529&entityType=region&limit=1000",
"fetched_at": "2026-11-05T22:25:29.074Z",
"raw_key": "raw/ioda/2026/11/05/222529Z-3f48baeb4d24.json"
},
{
"type": "event",
"id": "01M6PSYJH0M9SQVK0MQDFN9CJ1",
"source": "ioda",
"ts": "2026-11-05T21:31:00.000Z",
"tags": [
"ioda:critical",
"ioda:us_state"
],
"url": "https://ioda.inetintel.cc.gatech.edu/region/4414",
"source_url": "https://api.ioda.inetintel.cc.gatech.edu/v2/outages/alerts?from=1793907300&until=1793917529&entityType=region&limit=1000",
"fetched_at": "2026-11-05T22:25:29.074Z",
"raw_key": "raw/ioda/2026/11/05/222529Z-3f48baeb4d24.json"
},
{
"type": "event",
"id": "01M6MPHK3099B2ATF0J4H9TFG9",
"source": "ioda",
"ts": "2026-11-05T01:53:00.000Z",
"tags": [
"ioda:critical",
"ioda:us_state"
],
"url": "https://ioda.inetintel.cc.gatech.edu/region/4414",
"source_url": "https://api.ioda.inetintel.cc.gatech.edu/v2/outages/alerts?from=1793829329&until=1793850929&entityType=region&limit=1000",
"fetched_at": "2026-11-05T03:55:29.074Z",
"raw_key": "raw/ioda/2026/11/05/035529Z-b2c2f84dd8c8.json"
}
]
},
{
"sign_id": "fort_meade_ring",
"scenario_id": "cyber-us-infrastructure",
"words": "Fort Meade ring MAYDAY",
"plain": "Food places near Fort Meade are at MAYDAY",
"module": "mayday",
"kind": "alert",
"state": "NOT EVALUATED",
"confidence": "LOW",
"confidence_reason": "No data to judge.",
"why": "Not enough data in the last hour.",
"weight": 1,
"evaluated_at": "2026-11-06T00:00:00.000Z",
"fetched_at": null,
"findings": [],
"inputs": []
}
],
"fetched_at": "2026-11-05T23:20:29.074Z",
"version": "3b1a3fe432503d54a232e13103417d21775036b9"
}