[
 {
  "id": "alert-triage-123-000000",
  "pack": "alert-triage",
  "description": "Triage Alertmanager, Uptime Kuma and syslog events from a home lab.",
  "state": "{\n  \"source\": \"alertmanager\",\n  \"status\": \"firing\",\n  \"labels\": {\n    \"instance\": \"frigate:9100\",\n    \"job\": \"node\",\n    \"alertname\": \"HostTemperatureHigh\",\n    \"severity\": \"critical\"\n  },\n  \"annotations\": {\n    \"summary\": \"chassis temperature 63°C\",\n    \"description\": \"Sustained over 15m.\"\n  },\n  \"firing_for\": \"24h00m\",\n  \"context\": {\n    \"local_time\": \"Sun 22:00\",\n    \"host_role\": \"Frigate NVR box\",\n    \"maintenance_window\": true,\n    \"someone_home\": false\n  }\n}",
  "questions": "{\n  \"severity\": {\n    \"type\": \"score\",\n    \"instructions\": \"How quickly does this need attention?\",\n    \"criteria\": [\n      \"ignore, noise\",\n      \"low, look this week\",\n      \"medium, look today\",\n      \"high, look within the hour\",\n      \"critical, drop everything\"\n    ]\n  },\n  \"category\": {\n    \"type\": \"choice\",\n    \"instructions\": \"What kind of problem is this?\",\n    \"criteria\": {\n      \"storage\": \"disks, filesystems, pools, SMART\",\n      \"network\": \"connectivity, DNS, WAN, interfaces\",\n      \"compute\": \"CPU, memory, processes\",\n      \"service\": \"an application or container is unhealthy\",\n      \"security\": \"logins, intrusions, bans, suspicious activity\",\n      \"power_hardware\": \"UPS, temperature, fans, hardware errors\",\n      \"certificates\": \"TLS certificates and renewal\",\n      \"backup\": \"backup jobs and their age\"\n    }\n  },\n  \"wake_me\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Should this page the on-call person even at 3 am?\"\n  },\n  \"data_at_risk\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is there a risk of losing data?\"\n  }\n}"
 },
 {
  "id": "alert-triage-123-000001",
  "pack": "alert-triage",
  "description": "Triage Alertmanager, Uptime Kuma and syslog events from a home lab.",
  "state": "{\n  \"source\": \"alertmanager\",\n  \"status\": \"firing\",\n  \"labels\": {\n    \"instance\": \"backup01:9100\",\n    \"job\": \"node\",\n    \"alertname\": \"NodeFilesystemAlmostOutOfSpace\",\n    \"severity\": \"critical\"\n  },\n  \"annotations\": {\n    \"summary\": \"Filesystem /var is 97% full\",\n    \"description\": \"/var on backup01 has 3% space left and is predicted to fill up within 4h.\"\n  },\n  \"firing_for\": \"24h00m\",\n  \"context\": {\n    \"local_time\": \"Tue 15:45\",\n    \"host_role\": \"offsite backup target\",\n    \"maintenance_window\": false,\n    \"someone_home\": false\n  }\n}",
  "questions": "{\n  \"likely_noise\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this most likely a transient blip or a false alarm?\"\n  },\n  \"severity\": {\n    \"type\": \"score\",\n    \"instructions\": \"Rate the severity of this event.\",\n    \"criteria\": [\n      \"ignore, noise\",\n      \"low, look this week\",\n      \"medium, look today\",\n      \"high, look within the hour\",\n      \"critical, drop everything\"\n    ]\n  },\n  \"data_at_risk\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Could this lead to data loss if ignored?\"\n  },\n  \"actionable\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Should someone act on this event?\"\n  }\n}"
 },
 {
  "id": "alert-triage-123-000002",
  "pack": "alert-triage",
  "description": "Triage Alertmanager, Uptime Kuma and syslog events from a home lab.",
  "state": "{\n  \"source\": \"uptime-kuma\",\n  \"monitor\": \"sonarr (docker)\",\n  \"host\": \"homeassistant\",\n  \"status\": \"up\",\n  \"message\": \"Up after downtime\",\n  \"down_for\": null,\n  \"flaps_last_24h\": 2,\n  \"context\": {\n    \"local_time\": \"Mon 02:14\",\n    \"host_role\": \"Home Assistant VM\",\n    \"maintenance_window\": false,\n    \"someone_home\": true\n  }\n}",
  "questions": "{\n  \"wake_me\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this worth waking someone up at night?\"\n  },\n  \"likely_noise\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Will this probably resolve itself without intervention?\"\n  },\n  \"severity\": {\n    \"type\": \"score\",\n    \"instructions\": \"How urgent is this?\",\n    \"criteria\": [\n      \"ignore, noise\",\n      \"low, look this week\",\n      \"medium, look today\",\n      \"high, look within the hour\",\n      \"critical, drop everything\"\n    ]\n  },\n  \"data_at_risk\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Could this lead to data loss if ignored?\"\n  }\n}"
 },
 {
  "id": "frigate-triage-123-000000",
  "pack": "frigate-triage",
  "description": "Decide what to do about a Frigate NVR event from its metadata and household context.",
  "state": "{\n  \"source\": \"frigate\",\n  \"event\": {\n    \"camera\": \"street\",\n    \"label\": \"dog\",\n    \"top_score\": 0.64,\n    \"entered_zones\": [\n      \"street\",\n      \"sidewalk\"\n    ],\n    \"start\": \"Thu 11:18\",\n    \"duration_s\": 60,\n    \"stationary\": true,\n    \"false_positive_hint\": null,\n    \"genai_description\": \"A dog sniffs around the lawn.\"\n  },\n  \"household\": {\n    \"anyone_home\": true,\n    \"alarm\": \"disarmed\",\n    \"expecting_delivery\": false,\n    \"night_mode\": false\n  }\n}",
  "questions": "{\n  \"is_false_positive\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this likely a misdetection?\"\n  },\n  \"action\": {\n    \"type\": \"choice\",\n    \"instructions\": \"What should the system do?\",\n    \"criteria\": {\n      \"ignore\": \"drop the event\",\n      \"log\": \"keep the clip, no notification\",\n      \"notify\": \"push notification with snapshot\",\n      \"notify_urgent\": \"loud notification that breaks through do-not-disturb\",\n      \"alarm\": \"turn on lights and sound the siren\"\n    }\n  },\n  \"threat\": {\n    \"type\": \"score\",\n    \"instructions\": \"How concerning is this event from a security point of view?\",\n    \"criteria\": [\n      \"nothing to see\",\n      \"unremarkable\",\n      \"worth a look later\",\n      \"suspicious\",\n      \"possible intrusion or theft\"\n    ]\n  }\n}"
 },
 {
  "id": "frigate-triage-123-000001",
  "pack": "frigate-triage",
  "description": "Decide what to do about a Frigate NVR event from its metadata and household context.",
  "state": "{\n  \"source\": \"frigate\",\n  \"event\": {\n    \"camera\": \"driveway\",\n    \"label\": \"person\",\n    \"top_score\": 0.8,\n    \"entered_zones\": [\n      \"street\",\n      \"garage_door\"\n    ],\n    \"start\": \"Mon 04:48\",\n    \"duration_s\": 8,\n    \"stationary\": false,\n    \"false_positive_hint\": null\n  },\n  \"household\": {\n    \"anyone_home\": true,\n    \"alarm\": \"armed_home\",\n    \"expecting_delivery\": false,\n    \"night_mode\": true\n  }\n}",
  "questions": "{\n  \"threat\": {\n    \"type\": \"score\",\n    \"instructions\": \"Rate the threat level of this event.\",\n    \"criteria\": [\n      \"nothing to see\",\n      \"unremarkable\",\n      \"worth a look later\",\n      \"suspicious\",\n      \"possible intrusion or theft\"\n    ]\n  },\n  \"is_false_positive\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is the detection probably wrong?\"\n  }\n}"
 },
 {
  "id": "frigate-triage-123-000002",
  "pack": "frigate-triage",
  "description": "Decide what to do about a Frigate NVR event from its metadata and household context.",
  "state": "{\n  \"source\": \"frigate\",\n  \"event\": {\n    \"camera\": \"front_door\",\n    \"label\": \"bird\",\n    \"top_score\": 0.55,\n    \"entered_zones\": [\n      \"doorstep\",\n      \"porch\"\n    ],\n    \"start\": \"Sat 14:29\",\n    \"duration_s\": 180,\n    \"stationary\": false,\n    \"false_positive_hint\": \"rain on lens\",\n    \"genai_description\": \"A bird lands on the camera housing.\"\n  },\n  \"household\": {\n    \"anyone_home\": false,\n    \"alarm\": \"armed_away\",\n    \"expecting_delivery\": true,\n    \"night_mode\": false\n  }\n}",
  "questions": "{\n  \"category\": {\n    \"type\": \"choice\",\n    \"instructions\": \"What best describes this event?\",\n    \"criteria\": {\n      \"resident\": \"someone who lives here or their car\",\n      \"visitor\": \"a known or expected visitor\",\n      \"delivery\": \"a courier or a parcel\",\n      \"passerby\": \"someone or something just passing by\",\n      \"animal\": \"a pet or wildlife\",\n      \"suspicious\": \"unknown activity that looks out of place\"\n    }\n  },\n  \"threat\": {\n    \"type\": \"score\",\n    \"instructions\": \"How concerning is this event from a security point of view?\",\n    \"criteria\": [\n      \"nothing to see\",\n      \"unremarkable\",\n      \"worth a look later\",\n      \"suspicious\",\n      \"possible intrusion or theft\"\n    ]\n  },\n  \"is_false_positive\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this likely a misdetection?\"\n  },\n  \"notify\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this event worth a push notification?\"\n  },\n  \"action\": {\n    \"type\": \"choice\",\n    \"instructions\": \"Pick the right response to this event.\",\n    \"criteria\": {\n      \"ignore\": \"drop the event\",\n      \"log\": \"keep the clip, no notification\",\n      \"notify\": \"push notification with snapshot\",\n      \"notify_urgent\": \"loud notification that breaks through do-not-disturb\",\n      \"alarm\": \"turn on lights and sound the siren\"\n    }\n  }\n}"
 },
 {
  "id": "notify-gate-123-000000",
  "pack": "notify-gate",
  "description": "Gate Home Assistant notifications: drop, digest, push, or break through do-not-disturb.",
  "state": "{\n  \"source\": \"home-assistant\",\n  \"notification\": {\n    \"from\": \"Garage\",\n    \"kind\": \"garage_open_night\",\n    \"message\": \"The garage door is open and it is after sunset.\",\n    \"requested_priority\": \"normal\"\n  },\n  \"local_time\": \"Sun 01:51\",\n  \"household\": {\n    \"people_home\": [\n      \"Sam\",\n      \"kids\"\n    ],\n    \"sleeping\": true,\n    \"do_not_disturb\": true,\n    \"guests_over\": false,\n    \"on_vacation\": false\n  },\n  \"same_notification_last_24h\": 12\n}",
  "questions": "{\n  \"urgency\": {\n    \"type\": \"score\",\n    \"instructions\": \"How urgent is this notification?\",\n    \"criteria\": [\n      \"whenever\",\n      \"today\",\n      \"within the hour\",\n      \"within minutes\",\n      \"immediately, safety issue\"\n    ]\n  },\n  \"wake_up\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Should this wake a sleeping person?\"\n  },\n  \"safety\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Could ignoring this put people or property at risk?\"\n  },\n  \"channel\": {\n    \"type\": \"choice\",\n    \"instructions\": \"Pick the delivery channel for this notification.\",\n    \"criteria\": {\n      \"drop\": \"don't deliver it at all\",\n      \"digest\": \"include it in the daily summary\",\n      \"push\": \"normal push notification\",\n      \"critical\": \"loud alert that breaks through do-not-disturb\"\n    }\n  }\n}"
 },
 {
  "id": "notify-gate-123-000001",
  "pack": "notify-gate",
  "description": "Gate Home Assistant notifications: drop, digest, push, or break through do-not-disturb.",
  "state": "{\n  \"source\": \"home-assistant\",\n  \"notification\": {\n    \"from\": \"Updates\",\n    \"kind\": \"update\",\n    \"message\": \"Home Assistant Core 2026.10.1 is available.\",\n    \"requested_priority\": \"normal\"\n  },\n  \"local_time\": \"Sun 01:54\",\n  \"household\": {\n    \"people_home\": [],\n    \"sleeping\": true,\n    \"do_not_disturb\": false,\n    \"guests_over\": false,\n    \"on_vacation\": true\n  },\n  \"same_notification_last_24h\": 0\n}",
  "questions": "{\n  \"urgency\": {\n    \"type\": \"score\",\n    \"instructions\": \"How time-sensitive is this?\",\n    \"criteria\": [\n      \"whenever\",\n      \"today\",\n      \"within the hour\",\n      \"within minutes\",\n      \"immediately, safety issue\"\n    ]\n  },\n  \"channel\": {\n    \"type\": \"choice\",\n    \"instructions\": \"How should this notification be delivered?\",\n    \"criteria\": {\n      \"drop\": \"don't deliver it at all\",\n      \"digest\": \"include it in the daily summary\",\n      \"push\": \"normal push notification\",\n      \"critical\": \"loud alert that breaks through do-not-disturb\"\n    }\n  },\n  \"wake_up\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Should this wake a sleeping person?\"\n  }\n}"
 },
 {
  "id": "notify-gate-123-000002",
  "pack": "notify-gate",
  "description": "Gate Home Assistant notifications: drop, digest, push, or break through do-not-disturb.",
  "state": "{\n  \"source\": \"home-assistant\",\n  \"notification\": {\n    \"from\": \"Doors\",\n    \"kind\": \"door_open\",\n    \"message\": \"The patio door has been open for 10 minutes.\",\n    \"requested_priority\": \"normal\"\n  },\n  \"local_time\": \"Sun 01:24\",\n  \"household\": {\n    \"people_home\": [],\n    \"sleeping\": true,\n    \"do_not_disturb\": false,\n    \"guests_over\": false,\n    \"on_vacation\": false\n  },\n  \"same_notification_last_24h\": 0\n}",
  "questions": "{\n  \"safety\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Could ignoring this put people or property at risk?\"\n  },\n  \"urgency\": {\n    \"type\": \"score\",\n    \"instructions\": \"How time-sensitive is this?\",\n    \"criteria\": [\n      \"whenever\",\n      \"today\",\n      \"within the hour\",\n      \"within minutes\",\n      \"immediately, safety issue\"\n    ]\n  }\n}"
 },
 {
  "id": "protect-triage-123-000000",
  "pack": "protect-triage",
  "description": "Decide what to do about a UniFi Protect event (smart detection, audio, doorbell, camera health).",
  "state": "{\n  \"source\": \"unifi-protect\",\n  \"event\": {\n    \"camera\": \"Front Door\",\n    \"model\": \"G4 Doorbell Pro\",\n    \"type\": \"smartDetectLine\",\n    \"smartDetectTypes\": [\n      \"face\",\n      \"person\"\n    ],\n    \"score\": 95,\n    \"zone\": null,\n    \"face\": {\n      \"name\": \"Alex\",\n      \"group\": \"household\",\n      \"confidence\": 90\n    },\n    \"start\": \"Sat 16:35\",\n    \"duration_s\": 900\n  },\n  \"household\": {\n    \"people_home\": [],\n    \"alarm\": \"armed_away\",\n    \"quiet_hours\": false\n  }\n}",
  "questions": "{\n  \"category\": {\n    \"type\": \"choice\",\n    \"instructions\": \"Classify this event.\",\n    \"criteria\": {\n      \"household\": \"someone who lives here or their car\",\n      \"visitor\": \"a known visitor or someone at the door\",\n      \"delivery\": \"a courier or a parcel\",\n      \"passerby\": \"someone or something just passing by\",\n      \"animal\": \"a pet or wildlife\",\n      \"suspicious\": \"unknown activity that looks out of place\",\n      \"safety\": \"smoke, CO, glass break or a similar emergency\",\n      \"noise\": \"chatter, barking or other harmless sound\",\n      \"camera_health\": \"a problem with the camera or recorder itself\"\n    }\n  },\n  \"notify\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Should the household get a phone notification for this event?\"\n  },\n  \"urgency\": {\n    \"type\": \"score\",\n    \"instructions\": \"How urgent is this event?\",\n    \"criteria\": [\n      \"ignore\",\n      \"whenever\",\n      \"today\",\n      \"soon\",\n      \"right now\"\n    ]\n  },\n  \"action\": {\n    \"type\": \"choice\",\n    \"instructions\": \"What should the system do?\",\n    \"criteria\": {\n      \"ignore\": \"drop the event\",\n      \"log\": \"keep the clip, no notification\",\n      \"notify\": \"push notification with snapshot\",\n      \"notify_urgent\": \"loud notification that breaks through do-not-disturb\",\n      \"alarm\": \"turn on lights and sound the siren\"\n    }\n  }\n}"
 },
 {
  "id": "protect-triage-123-000001",
  "pack": "protect-triage",
  "description": "Decide what to do about a UniFi Protect event (smart detection, audio, doorbell, camera health).",
  "state": "{\n  \"source\": \"unifi-protect\",\n  \"event\": {\n    \"camera\": \"Front Door\",\n    \"model\": \"G4 Doorbell Pro\",\n    \"type\": \"smartAudioDetect\",\n    \"smartDetectTypes\": [\n      \"alrmSpeak\"\n    ],\n    \"score\": 63,\n    \"start\": \"Sat 02:56\",\n    \"duration_s\": 900\n  },\n  \"household\": {\n    \"people_home\": [\n      \"Jordan\"\n    ],\n    \"alarm\": \"disarmed\",\n    \"quiet_hours\": true\n  }\n}",
  "questions": "{\n  \"notify\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this Protect event worth a push notification?\"\n  },\n  \"is_emergency\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this a possible life-safety emergency?\"\n  },\n  \"urgency\": {\n    \"type\": \"score\",\n    \"instructions\": \"How urgent is this event?\",\n    \"criteria\": [\n      \"ignore\",\n      \"whenever\",\n      \"today\",\n      \"soon\",\n      \"right now\"\n    ]\n  },\n  \"category\": {\n    \"type\": \"choice\",\n    \"instructions\": \"Classify this event.\",\n    \"criteria\": {\n      \"visitor\": \"a known visitor or someone at the door\",\n      \"delivery\": \"a courier or a parcel\",\n      \"passerby\": \"someone or something just passing by\",\n      \"animal\": \"a pet or wildlife\",\n      \"suspicious\": \"unknown activity that looks out of place\",\n      \"safety\": \"smoke, CO, glass break or a similar emergency\",\n      \"noise\": \"chatter, barking or other harmless sound\",\n      \"camera_health\": \"a problem with the camera or recorder itself\"\n    }\n  }\n}"
 },
 {
  "id": "protect-triage-123-000002",
  "pack": "protect-triage",
  "description": "Decide what to do about a UniFi Protect event (smart detection, audio, doorbell, camera health).",
  "state": "{\n  \"source\": \"unifi-protect\",\n  \"event\": {\n    \"camera\": \"Front Door\",\n    \"model\": \"G4 Doorbell Pro\",\n    \"type\": \"ring\",\n    \"also_seen\": [\n      \"person\"\n    ],\n    \"start\": \"Mon 03:42\",\n    \"duration_s\": 900\n  },\n  \"household\": {\n    \"people_home\": [\n      \"Alex\",\n      \"Jordan\",\n      \"Mia\",\n      \"Sam\"\n    ],\n    \"alarm\": \"disarmed\",\n    \"quiet_hours\": true\n  }\n}",
  "questions": "{\n  \"action\": {\n    \"type\": \"choice\",\n    \"instructions\": \"Pick the right response to this event.\",\n    \"criteria\": {\n      \"ignore\": \"drop the event\",\n      \"log\": \"keep the clip, no notification\",\n      \"notify\": \"push notification with snapshot\",\n      \"notify_urgent\": \"loud notification that breaks through do-not-disturb\",\n      \"alarm\": \"turn on lights and sound the siren\"\n    }\n  },\n  \"urgency\": {\n    \"type\": \"score\",\n    \"instructions\": \"How urgent is this event?\",\n    \"criteria\": [\n      \"ignore\",\n      \"whenever\",\n      \"today\",\n      \"soon\",\n      \"right now\"\n    ]\n  },\n  \"notify\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Should someone be told about this right now?\"\n  },\n  \"is_emergency\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Could this be a fire, CO or break-in emergency?\"\n  }\n}"
 },
 {
  "id": "unifi-network-123-000000",
  "pack": "unifi-network",
  "description": "Triage UniFi Network events: WAN health, device outages, clients, IPS hits and admin logins.",
  "state": "{\n  \"source\": \"unifi-network\",\n  \"event\": {\n    \"key\": \"NETWORK_WAN_RESTORED_2\",\n    \"time\": \"Sun 10:02\",\n    \"wan\": \"WAN2\",\n    \"failover_active\": false,\n    \"other_wan_up\": true,\n    \"outage_min\": 600\n  },\n  \"context\": {\n    \"owner_home\": false,\n    \"quiet_hours\": false,\n    \"maintenance_window\": true\n  }\n}",
  "questions": "{\n  \"action\": {\n    \"type\": \"choice\",\n    \"instructions\": \"Pick the right handling for this event.\",\n    \"criteria\": {\n      \"ignore\": \"drop it\",\n      \"log\": \"keep it in the log only\",\n      \"notify\": \"push notification\",\n      \"page\": \"urgent notification that breaks through do-not-disturb\"\n    }\n  },\n  \"notify\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this network event worth a push notification?\"\n  },\n  \"severity\": {\n    \"type\": \"score\",\n    \"instructions\": \"Rate the impact of this event on the home network.\",\n    \"criteria\": [\n      \"noise\",\n      \"informational\",\n      \"minor\",\n      \"degraded service\",\n      \"outage or security incident\"\n    ]\n  },\n  \"category\": {\n    \"type\": \"choice\",\n    \"instructions\": \"What kind of event is this?\",\n    \"criteria\": {\n      \"client_churn\": \"routine client connect, disconnect or roam\",\n      \"new_device\": \"a device not seen before\",\n      \"internet\": \"WAN or ISP problem\",\n      \"infrastructure\": \"a UniFi device or switch port problem\",\n      \"security\": \"intrusion attempt, malware or suspicious access\",\n      \"admin\": \"management access\",\n      \"maintenance\": \"updates and housekeeping\"\n    }\n  },\n  \"is_security_relevant\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Could this indicate a compromise or an intrusion attempt?\"\n  }\n}"
 },
 {
  "id": "unifi-network-123-000001",
  "pack": "unifi-network",
  "description": "Triage UniFi Network events: WAN health, device outages, clients, IPS hits and admin logins.",
  "state": "{\n  \"source\": \"unifi-network\",\n  \"event\": {\n    \"key\": \"ADMIN_ACCESS\",\n    \"time\": \"Thu 04:10\",\n    \"admin\": \"api-key: home-assistant\",\n    \"ip\": \"198.51.100.23\",\n    \"remote\": true,\n    \"country\": \"DE\",\n    \"known_location\": true,\n    \"platform\": \"api\",\n    \"mfa\": false\n  },\n  \"context\": {\n    \"owner_home\": false,\n    \"quiet_hours\": true,\n    \"maintenance_window\": false\n  }\n}",
  "questions": "{\n  \"action\": {\n    \"type\": \"choice\",\n    \"instructions\": \"What should happen with this event?\",\n    \"criteria\": {\n      \"ignore\": \"drop it\",\n      \"log\": \"keep it in the log only\",\n      \"digest\": \"include in the daily summary\",\n      \"notify\": \"push notification\",\n      \"page\": \"urgent notification that breaks through do-not-disturb\"\n    }\n  },\n  \"severity\": {\n    \"type\": \"score\",\n    \"instructions\": \"Rate the impact of this event on the home network.\",\n    \"criteria\": [\n      \"noise\",\n      \"informational\",\n      \"minor\",\n      \"degraded service\",\n      \"outage or security incident\"\n    ]\n  },\n  \"notify\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this network event worth a push notification?\"\n  },\n  \"is_security_relevant\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Could this indicate a compromise or an intrusion attempt?\"\n  },\n  \"category\": {\n    \"type\": \"choice\",\n    \"instructions\": \"Classify this network event.\",\n    \"criteria\": {\n      \"client_churn\": \"routine client connect, disconnect or roam\",\n      \"new_device\": \"a device not seen before\",\n      \"internet\": \"WAN or ISP problem\",\n      \"infrastructure\": \"a UniFi device or switch port problem\",\n      \"security\": \"intrusion attempt, malware or suspicious access\",\n      \"admin\": \"management access\",\n      \"maintenance\": \"updates and housekeeping\"\n    }\n  }\n}"
 },
 {
  "id": "unifi-network-123-000002",
  "pack": "unifi-network",
  "description": "Triage UniFi Network events: WAN health, device outages, clients, IPS hits and admin logins.",
  "state": "{\n  \"source\": \"unifi-network\",\n  \"event\": {\n    \"key\": \"NETWORK_WAN_FAILED_2\",\n    \"time\": \"Mon 00:47\",\n    \"wan\": \"WAN1\",\n    \"failover_active\": true,\n    \"other_wan_up\": true\n  },\n  \"context\": {\n    \"owner_home\": false,\n    \"quiet_hours\": true,\n    \"maintenance_window\": false\n  }\n}",
  "questions": "{\n  \"action\": {\n    \"type\": \"choice\",\n    \"instructions\": \"Pick the right handling for this event.\",\n    \"criteria\": {\n      \"ignore\": \"drop it\",\n      \"log\": \"keep it in the log only\",\n      \"digest\": \"include in the daily summary\",\n      \"page\": \"urgent notification that breaks through do-not-disturb\"\n    }\n  },\n  \"notify\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this network event worth a push notification?\"\n  },\n  \"is_security_relevant\": {\n    \"type\": \"noul\",\n    \"instructions\": \"Is this event security-relevant?\"\n  },\n  \"category\": {\n    \"type\": \"choice\",\n    \"instructions\": \"Classify this network event.\",\n    \"criteria\": {\n      \"client_churn\": \"routine client connect, disconnect or roam\",\n      \"new_device\": \"a device not seen before\",\n      \"internet\": \"WAN or ISP problem\",\n      \"infrastructure\": \"a UniFi device or switch port problem\",\n      \"security\": \"intrusion attempt, malware or suspicious access\",\n      \"maintenance\": \"updates and housekeeping\"\n    }\n  },\n  \"severity\": {\n    \"type\": \"score\",\n    \"instructions\": \"Rate the impact of this event on the home network.\",\n    \"criteria\": [\n      \"noise\",\n      \"informational\",\n      \"minor\",\n      \"degraded service\",\n      \"outage or security incident\"\n    ]\n  }\n}"
 }
]