[
  {
    "vendor": "meraki",
    "orgId": "org_demo",
    "faultClass": "connectivity_loss",
    "severity": "critical",
    "title": "Connectivity loss on hq-mx-01",
    "summary": "hq-mx-01 stopped responding to the Meraki cloud 18 min ago.",
    "network": {
      "id": "N_hq",
      "name": "HQ - Floor 2"
    },
    "device": {
      "id": "Q2XX-AAAA-1111",
      "name": "hq-mx-01",
      "model": "MX68",
      "vendor": "meraki"
    },
    "signals": [
      {
        "id": "pZKFyIDf",
        "kind": "device_unreachable",
        "label": "Device unreachable",
        "value": true,
        "observedAt": "2026-05-29T21:17:22.110Z",
        "source": "meraki"
      },
      {
        "id": "9T_fjzPL",
        "kind": "uplink_down",
        "label": "Uplink down for",
        "value": 18,
        "unit": "min",
        "observedAt": "2026-05-29T21:17:22.110Z",
        "source": "meraki"
      },
      {
        "id": "3jN94RZ0",
        "kind": "packet_loss",
        "label": "Uplink packet loss",
        "value": 12,
        "unit": "%",
        "observedAt": "2026-05-29T21:17:22.110Z",
        "source": "meraki"
      }
    ],
    "rawEventRefs": [
      "alert_uEm1Dfd2"
    ],
    "detectedAt": "2026-05-29T21:17:22.110Z",
    "id": "f_meraki_connectivity_loss_N_hq_Q2XX_AAAA_1111",
    "status": "proposed",
    "updatedAt": "2026-05-29T21:36:22.116Z",
    "rca": {
      "cause": "Upstream uplink/WAN link down or device hardware unresponsive",
      "confidence": 0.84,
      "summary": "The device has been unreachable from the cloud for over ten minutes with no telemetry, consistent with a downed uplink or a hung device rather than a transient blip.",
      "evidence": [
        {
          "signalId": "pZKFyIDf",
          "statement": "Device is not responding to the Meraki cloud at all."
        },
        {
          "signalId": "9T_fjzPL",
          "statement": "Uplink has been down long enough to rule out a transient flap."
        },
        {
          "signalId": "3jN94RZ0",
          "statement": "Elevated packet loss preceded the outage, pointing upstream."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.116Z"
    },
    "proposal": {
      "id": "xS1AOyHRh9",
      "faultId": "f_meraki_connectivity_loss_N_hq_Q2XX_AAAA_1111",
      "vendor": "meraki",
      "playbookId": "meraki.connectivity.reboot_and_recheck",
      "title": "Reboot device and re-verify uplink",
      "description": "Power-cycle the unreachable device via the Dashboard API, then re-poll its uplink status to confirm recovery before closing the fault.",
      "steps": [
        {
          "order": 1,
          "action": "Reboot device Q2XX-AAAA-1111",
          "apiCall": {
            "vendor": "meraki",
            "method": "POST",
            "endpoint": "/devices/Q2XX-AAAA-1111/reboot"
          }
        },
        {
          "order": 2,
          "action": "Re-poll uplink status to confirm the device is back online",
          "apiCall": {
            "vendor": "meraki",
            "method": "GET",
            "endpoint": "/devices/Q2XX-AAAA-1111/lossAndLatencyHistory"
          }
        }
      ],
      "risk": "medium",
      "requiresApproval": true,
      "status": "pending",
      "confidenceAtProposal": 0.84,
      "createdAt": "2026-05-29T21:36:22.116Z"
    }
  },
  {
    "vendor": "meraki",
    "orgId": "org_demo",
    "faultClass": "connectivity_loss",
    "severity": "high",
    "title": "Connectivity loss on branch-mr-01",
    "summary": "branch-mr-01 stopped responding to the Meraki cloud 3 min ago.",
    "network": {
      "id": "N_branch",
      "name": "Branch - Oakland"
    },
    "device": {
      "id": "Q2ZZ-CCCC-3333",
      "name": "branch-mr-01",
      "model": "MR46",
      "vendor": "meraki"
    },
    "signals": [
      {
        "id": "oCLsuzo9",
        "kind": "device_unreachable",
        "label": "Device unreachable",
        "value": true,
        "observedAt": "2026-05-29T21:32:22.115Z",
        "source": "meraki"
      },
      {
        "id": "DJwe7j-x",
        "kind": "uplink_down",
        "label": "Uplink down for",
        "value": 3,
        "unit": "min",
        "observedAt": "2026-05-29T21:32:22.115Z",
        "source": "meraki"
      }
    ],
    "rawEventRefs": [
      "alert_p6lfi2RP"
    ],
    "detectedAt": "2026-05-29T21:32:22.115Z",
    "id": "f_meraki_connectivity_loss_N_branch_Q2ZZ_CCCC_3333",
    "status": "triage",
    "updatedAt": "2026-05-29T21:36:22.116Z",
    "rca": {
      "cause": "Intermittent uplink instability",
      "confidence": 0.58,
      "summary": "Short downtime with limited corroborating signal; could be a transient flap. Surface for human triage rather than auto-proposing a reboot.",
      "evidence": [
        {
          "signalId": "DJwe7j-x",
          "statement": "Downtime is brief and may self-recover."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.116Z"
    }
  },
  {
    "vendor": "meraki",
    "orgId": "org_demo",
    "faultClass": "dhcp_dns",
    "severity": "high",
    "title": "DHCP failures on Warehouse",
    "summary": "Clients on Warehouse are failing to obtain DHCP leases.",
    "network": {
      "id": "N_warehouse",
      "name": "Warehouse"
    },
    "signals": [
      {
        "id": "3o9H9IG5",
        "kind": "dhcp_lease_failures",
        "label": "DHCP lease failures (5 min)",
        "value": 44,
        "observedAt": "2026-05-29T21:29:22.115Z",
        "source": "meraki"
      },
      {
        "id": "4TrQxz9s",
        "kind": "dhcp_pool_exhaustion",
        "label": "DHCP pool utilization",
        "value": 98,
        "unit": "%",
        "observedAt": "2026-05-29T21:29:22.115Z",
        "source": "meraki"
      }
    ],
    "rawEventRefs": [
      "alert_QBLTyw02"
    ],
    "detectedAt": "2026-05-29T21:29:22.115Z",
    "id": "f_meraki_dhcp_dns_N_warehouse_",
    "status": "proposed",
    "updatedAt": "2026-05-29T21:36:22.117Z",
    "rca": {
      "cause": "DHCP scope exhausted — lease pool fully allocated",
      "confidence": 0.86,
      "summary": "Pool utilization is at or above 95% while clients report lease failures, a direct exhaustion signature. Widening the scope should restore issuance.",
      "evidence": [
        {
          "signalId": "4TrQxz9s",
          "statement": "Lease pool is effectively full."
        },
        {
          "signalId": "3o9H9IG5",
          "statement": "Clients are actively failing to obtain leases."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.116Z"
    },
    "proposal": {
      "id": "8h0qMbGHzO",
      "faultId": "f_meraki_dhcp_dns_N_warehouse_",
      "vendor": "meraki",
      "playbookId": "meraki.dhcp.expand_pool_and_fix_dns",
      "title": "Expand DHCP scope and correct DNS",
      "description": "Widen the DHCP lease range on the affected VLAN to relieve pool exhaustion and reset the configured DNS servers to the network default, then verify lease issuance.",
      "steps": [
        {
          "order": 1,
          "action": "Expand DHCP lease range on the appliance VLAN for network N_warehouse",
          "apiCall": {
            "vendor": "meraki",
            "method": "PUT",
            "endpoint": "/networks/N_warehouse/appliance/vlans/{vlanId}"
          }
        },
        {
          "order": 2,
          "action": "Reset DNS nameservers to the upstream resolver default",
          "apiCall": {
            "vendor": "meraki",
            "method": "PUT",
            "endpoint": "/networks/N_warehouse/appliance/vlans/{vlanId}"
          }
        }
      ],
      "risk": "medium",
      "requiresApproval": true,
      "status": "pending",
      "confidenceAtProposal": 0.86,
      "createdAt": "2026-05-29T21:36:22.117Z"
    }
  },
  {
    "vendor": "meraki",
    "orgId": "org_demo",
    "faultClass": "dhcp_dns",
    "severity": "high",
    "title": "DNS resolution failures on HQ - Floor 2",
    "summary": "Clients on HQ - Floor 2 cannot resolve hostnames.",
    "network": {
      "id": "N_hq",
      "name": "HQ - Floor 2"
    },
    "signals": [
      {
        "id": "IOeXPRx5",
        "kind": "dns_resolution_failures",
        "label": "Failed DNS lookups (5 min)",
        "value": 320,
        "observedAt": "2026-05-29T21:25:22.115Z",
        "source": "meraki"
      }
    ],
    "rawEventRefs": [
      "alert_drb0XhMf"
    ],
    "detectedAt": "2026-05-29T21:25:22.115Z",
    "id": "f_meraki_dhcp_dns_N_hq_",
    "status": "proposed",
    "updatedAt": "2026-05-29T21:36:22.117Z",
    "rca": {
      "cause": "DNS resolver unreachable or misconfigured",
      "confidence": 0.74,
      "summary": "DNS lookups are failing without a matching DHCP problem, isolating the fault to name resolution rather than addressing.",
      "evidence": [
        {
          "signalId": "IOeXPRx5",
          "statement": "Failed lookups with no DHCP-side failures point at the resolver."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.117Z"
    },
    "proposal": {
      "id": "HnI27ipav4",
      "faultId": "f_meraki_dhcp_dns_N_hq_",
      "vendor": "meraki",
      "playbookId": "meraki.dhcp.expand_pool_and_fix_dns",
      "title": "Expand DHCP scope and correct DNS",
      "description": "Widen the DHCP lease range on the affected VLAN to relieve pool exhaustion and reset the configured DNS servers to the network default, then verify lease issuance.",
      "steps": [
        {
          "order": 1,
          "action": "Expand DHCP lease range on the appliance VLAN for network N_hq",
          "apiCall": {
            "vendor": "meraki",
            "method": "PUT",
            "endpoint": "/networks/N_hq/appliance/vlans/{vlanId}"
          }
        },
        {
          "order": 2,
          "action": "Reset DNS nameservers to the upstream resolver default",
          "apiCall": {
            "vendor": "meraki",
            "method": "PUT",
            "endpoint": "/networks/N_hq/appliance/vlans/{vlanId}"
          }
        }
      ],
      "risk": "medium",
      "requiresApproval": true,
      "status": "pending",
      "confidenceAtProposal": 0.74,
      "createdAt": "2026-05-29T21:36:22.117Z"
    }
  },
  {
    "vendor": "meraki",
    "orgId": "org_demo",
    "faultClass": "wifi_performance",
    "severity": "high",
    "title": "Wi-Fi performance degraded on branch-mr-01",
    "summary": "branch-mr-01 shows high airtime contention and degraded client experience.",
    "network": {
      "id": "N_hq",
      "name": "HQ - Floor 2"
    },
    "device": {
      "id": "Q2ZZ-CCCC-3333",
      "name": "branch-mr-01",
      "model": "MR46",
      "vendor": "meraki"
    },
    "signals": [
      {
        "id": "x-OhZtUf",
        "kind": "channel_utilization",
        "label": "2.4/5GHz channel utilization",
        "value": 88,
        "unit": "%",
        "observedAt": "2026-05-29T21:30:22.115Z",
        "source": "meraki"
      },
      {
        "id": "__xYnSW_",
        "kind": "retry_rate",
        "label": "Wireless retry rate",
        "value": 31,
        "unit": "%",
        "observedAt": "2026-05-29T21:30:22.115Z",
        "source": "meraki"
      },
      {
        "id": "bKMHxpH6",
        "kind": "client_count_drop",
        "label": "Associated client drop",
        "value": 22,
        "unit": "%",
        "observedAt": "2026-05-29T21:30:22.115Z",
        "source": "meraki"
      }
    ],
    "rawEventRefs": [
      "alert_HJNW07Po"
    ],
    "detectedAt": "2026-05-29T21:30:22.115Z",
    "id": "f_meraki_wifi_performance_N_hq_Q2ZZ_CCCC_3333",
    "status": "proposed",
    "updatedAt": "2026-05-29T21:36:22.117Z",
    "rca": {
      "cause": "Severe airtime contention from co-channel interference",
      "confidence": 0.79,
      "summary": "Channel utilization is saturated with an elevated retry rate, the classic co-channel interference signature. An RF channel rebalance should relieve it.",
      "evidence": [
        {
          "signalId": "x-OhZtUf",
          "statement": "Channel airtime is saturated."
        },
        {
          "signalId": "__xYnSW_",
          "statement": "High retry rate confirms contention rather than client-side issues."
        },
        {
          "signalId": "bKMHxpH6",
          "statement": "Clients are dropping off as the channel degrades."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.117Z"
    },
    "proposal": {
      "id": "d0OtsL-Kuh",
      "faultId": "f_meraki_wifi_performance_N_hq_Q2ZZ_CCCC_3333",
      "vendor": "meraki",
      "playbookId": "meraki.wifi.rebalance_channels",
      "title": "Re-run auto RF and rebalance channels",
      "description": "Trigger an auto-RF channel reassignment on the affected access point to move it off the congested channel and lower airtime contention.",
      "steps": [
        {
          "order": 1,
          "action": "Apply a less-congested channel to Q2ZZ-CCCC-3333 via radio settings",
          "apiCall": {
            "vendor": "meraki",
            "method": "PUT",
            "endpoint": "/devices/Q2ZZ-CCCC-3333/wireless/radio/settings"
          }
        }
      ],
      "risk": "low",
      "requiresApproval": true,
      "status": "pending",
      "confidenceAtProposal": 0.79,
      "createdAt": "2026-05-29T21:36:22.117Z"
    }
  },
  {
    "vendor": "meraki",
    "orgId": "org_demo",
    "faultClass": "wifi_performance",
    "severity": "medium",
    "title": "Wi-Fi performance degraded on branch-mr-01",
    "summary": "branch-mr-01 shows high airtime contention and degraded client experience.",
    "network": {
      "id": "N_branch",
      "name": "Branch - Oakland"
    },
    "device": {
      "id": "Q2ZZ-CCCC-3333",
      "name": "branch-mr-01",
      "model": "MR46",
      "vendor": "meraki"
    },
    "signals": [
      {
        "id": "NKe7AA7f",
        "kind": "channel_utilization",
        "label": "2.4/5GHz channel utilization",
        "value": 62,
        "unit": "%",
        "observedAt": "2026-05-29T21:27:22.115Z",
        "source": "meraki"
      }
    ],
    "rawEventRefs": [
      "alert_mXp2Z3Y1"
    ],
    "detectedAt": "2026-05-29T21:27:22.115Z",
    "id": "f_meraki_wifi_performance_N_branch_Q2ZZ_CCCC_3333",
    "status": "triage",
    "updatedAt": "2026-05-29T21:36:22.117Z",
    "rca": {
      "cause": "Moderate Wi-Fi degradation, source unclear",
      "confidence": 0.6,
      "summary": "Performance is degraded but airtime is not clearly saturated; could be client-side or interference. Surface for human triage.",
      "evidence": [
        {
          "signalId": "NKe7AA7f",
          "statement": "Utilization elevated but below the contention threshold."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.117Z"
    }
  },
  {
    "vendor": "unifi",
    "orgId": "org_demo",
    "faultClass": "connectivity_loss",
    "severity": "critical",
    "title": "Connectivity loss on mtnview-udm-pro",
    "summary": "mtnview-udm-pro dropped off the UniFi controller 11 min ago.",
    "network": {
      "id": "site_mtnview",
      "name": "Mountain View Office"
    },
    "device": {
      "id": "f4:e2:c6:10:22:01",
      "name": "mtnview-udm-pro",
      "model": "UDM-Pro",
      "vendor": "unifi"
    },
    "signals": [
      {
        "id": "n_1g49Jz",
        "kind": "device_unreachable",
        "label": "Device unreachable",
        "value": true,
        "observedAt": "2026-05-29T21:24:22.117Z",
        "source": "unifi"
      },
      {
        "id": "xkhZt7wh",
        "kind": "uplink_down",
        "label": "Uplink down for",
        "value": 11,
        "unit": "min",
        "observedAt": "2026-05-29T21:24:22.117Z",
        "source": "unifi"
      },
      {
        "id": "SBnDHJFu",
        "kind": "packet_loss",
        "label": "WAN packet loss",
        "value": 100,
        "unit": "%",
        "observedAt": "2026-05-29T21:24:22.117Z",
        "source": "unifi"
      }
    ],
    "rawEventRefs": [
      "EVT_GW_WANTransition:2026-05-29T21:24:22.117Z"
    ],
    "detectedAt": "2026-05-29T21:24:22.117Z",
    "id": "f_unifi_connectivity_loss_site_mtnview_f4_e2_c6_10_22_01",
    "status": "proposed",
    "updatedAt": "2026-05-29T21:36:22.118Z",
    "rca": {
      "cause": "Upstream uplink/WAN link down or device hardware unresponsive",
      "confidence": 0.84,
      "summary": "The device has been unreachable from the cloud for over ten minutes with no telemetry, consistent with a downed uplink or a hung device rather than a transient blip.",
      "evidence": [
        {
          "signalId": "n_1g49Jz",
          "statement": "Device is not responding to the Meraki cloud at all."
        },
        {
          "signalId": "xkhZt7wh",
          "statement": "Uplink has been down long enough to rule out a transient flap."
        },
        {
          "signalId": "SBnDHJFu",
          "statement": "Elevated packet loss preceded the outage, pointing upstream."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.117Z"
    },
    "proposal": {
      "id": "q8TaC6o5Tr",
      "faultId": "f_unifi_connectivity_loss_site_mtnview_f4_e2_c6_10_22_01",
      "vendor": "unifi",
      "playbookId": "unifi.connectivity.restart_and_failover",
      "title": "Restart device and confirm WAN failover",
      "description": "Restart the unreachable UniFi device through the controller, then confirm the gateway failed over to the secondary WAN before closing the fault.",
      "steps": [
        {
          "order": 1,
          "action": "Restart device f4:e2:c6:10:22:01 via the controller",
          "apiCall": {
            "vendor": "unifi",
            "method": "POST",
            "endpoint": "/api/s/site_mtnview/cmd/devmgr"
          }
        },
        {
          "order": 2,
          "action": "Confirm WAN failover and uplink health",
          "apiCall": {
            "vendor": "unifi",
            "method": "GET",
            "endpoint": "/api/s/site_mtnview/stat/health"
          }
        }
      ],
      "risk": "medium",
      "requiresApproval": true,
      "status": "pending",
      "confidenceAtProposal": 0.84,
      "createdAt": "2026-05-29T21:36:22.118Z"
    }
  },
  {
    "vendor": "unifi",
    "orgId": "org_demo",
    "faultClass": "wifi_performance",
    "severity": "high",
    "title": "Wi-Fi performance degraded on mtnview-u6-lr",
    "summary": "mtnview-u6-lr shows high airtime contention and degraded client experience.",
    "network": {
      "id": "site_mtnview",
      "name": "Mountain View Office"
    },
    "device": {
      "id": "f4:e2:c6:10:22:0a",
      "name": "mtnview-u6-lr",
      "model": "U6-LR",
      "vendor": "unifi"
    },
    "signals": [
      {
        "id": "zqn-EcxK",
        "kind": "channel_utilization",
        "label": "Channel utilization",
        "value": 84,
        "unit": "%",
        "observedAt": "2026-05-29T21:30:22.117Z",
        "source": "unifi"
      },
      {
        "id": "Xa0ffP8h",
        "kind": "retry_rate",
        "label": "Wireless retry rate",
        "value": 27,
        "unit": "%",
        "observedAt": "2026-05-29T21:30:22.117Z",
        "source": "unifi"
      }
    ],
    "rawEventRefs": [
      "EVT_AP_ChannelUtilHigh:2026-05-29T21:30:22.117Z"
    ],
    "detectedAt": "2026-05-29T21:30:22.117Z",
    "id": "f_unifi_wifi_performance_site_mtnview_f4_e2_c6_10_22_0a",
    "status": "proposed",
    "updatedAt": "2026-05-29T21:36:22.118Z",
    "rca": {
      "cause": "Severe airtime contention from co-channel interference",
      "confidence": 0.79,
      "summary": "Channel utilization is saturated with an elevated retry rate, the classic co-channel interference signature. An RF channel rebalance should relieve it.",
      "evidence": [
        {
          "signalId": "zqn-EcxK",
          "statement": "Channel airtime is saturated."
        },
        {
          "signalId": "Xa0ffP8h",
          "statement": "High retry rate confirms contention rather than client-side issues."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.118Z"
    },
    "proposal": {
      "id": "X7nIHy1FNC",
      "faultId": "f_unifi_wifi_performance_site_mtnview_f4_e2_c6_10_22_0a",
      "vendor": "unifi",
      "playbookId": "unifi.wifi.rebalance_channels",
      "title": "Reassign the AP channel to reduce contention",
      "description": "Move the access point off the congested channel via the controller to lower airtime utilization and improve client throughput.",
      "steps": [
        {
          "order": 1,
          "action": "Set a less-congested channel on f4:e2:c6:10:22:0a",
          "apiCall": {
            "vendor": "unifi",
            "method": "PUT",
            "endpoint": "/api/s/site_mtnview/rest/device/{id}"
          }
        }
      ],
      "risk": "low",
      "requiresApproval": true,
      "status": "pending",
      "confidenceAtProposal": 0.79,
      "createdAt": "2026-05-29T21:36:22.118Z"
    }
  },
  {
    "vendor": "probe",
    "orgId": "org_demo",
    "faultClass": "dhcp_dns",
    "severity": "medium",
    "title": "DNS resolution failing",
    "summary": "studio-imac failed to resolve 8 of 10 known domains (github.com, slack.com).",
    "network": {
      "id": "lan_home",
      "name": "Home LAN"
    },
    "device": {
      "id": "studio-imac",
      "name": "studio-imac",
      "model": "host probe",
      "vendor": "probe"
    },
    "signals": [
      {
        "id": "5nrDOFsR",
        "kind": "dns_resolution_failures",
        "label": "Failed DNS lookups (8/10)",
        "value": 8,
        "observedAt": "2026-05-29T21:30:22.118Z",
        "source": "probe"
      },
      {
        "id": "JHGoUuh9",
        "kind": "latency_spike",
        "label": "DNS resolution latency",
        "value": 850,
        "unit": "ms",
        "observedAt": "2026-05-29T21:30:22.118Z",
        "source": "probe"
      }
    ],
    "rawEventRefs": [
      "probe_dns_2026-05-29T21:30:22.118Z"
    ],
    "detectedAt": "2026-05-29T21:30:22.118Z",
    "id": "f_probe_dhcp_dns_lan_home_studio_imac",
    "status": "proposed",
    "updatedAt": "2026-05-29T21:36:22.118Z",
    "rca": {
      "cause": "DNS resolver unreachable or misconfigured",
      "confidence": 0.74,
      "summary": "DNS lookups are failing without a matching DHCP problem, isolating the fault to name resolution rather than addressing.",
      "evidence": [
        {
          "signalId": "5nrDOFsR",
          "statement": "Failed lookups with no DHCP-side failures point at the resolver."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.118Z"
    },
    "proposal": {
      "id": "wIxAOD2SR1",
      "faultId": "f_probe_dhcp_dns_lan_home_studio_imac",
      "vendor": "probe",
      "playbookId": "probe.dns.flush_resolver_cache",
      "title": "Flush the DNS resolver cache",
      "description": "Clear this host's DNS resolver cache so stale or poisoned entries are dropped and lookups re-resolve against the configured nameservers. Safe and non-disruptive — it does not drop the network connection.",
      "steps": [
        {
          "order": 1,
          "action": "Flush the Windows DNS resolver cache",
          "apiCall": {
            "vendor": "probe",
            "method": "POST",
            "endpoint": "host:ipconfig /flushdns"
          }
        }
      ],
      "risk": "low",
      "requiresApproval": true,
      "status": "pending",
      "confidenceAtProposal": 0.74,
      "createdAt": "2026-05-29T21:36:22.118Z"
    }
  },
  {
    "vendor": "probe",
    "orgId": "org_demo",
    "faultClass": "wifi_performance",
    "severity": "medium",
    "title": "Weak Wi-Fi signal on Auxon-5G",
    "summary": "studio-imac has 23% Wi-Fi signal on Auxon-5G, degrading throughput and reliability.",
    "network": {
      "id": "lan_home",
      "name": "Home LAN"
    },
    "device": {
      "id": "studio-imac",
      "name": "studio-imac",
      "model": "host probe",
      "vendor": "probe"
    },
    "signals": [
      {
        "id": "bpzGvjCq",
        "kind": "signal_strength",
        "label": "Wi-Fi signal strength",
        "value": 23,
        "unit": "%",
        "observedAt": "2026-05-29T21:32:22.118Z",
        "source": "probe"
      },
      {
        "id": "YHYTROnJ",
        "kind": "channel_utilization",
        "label": "Channel 149 (5GHz)",
        "value": 149,
        "observedAt": "2026-05-29T21:32:22.118Z",
        "source": "probe"
      },
      {
        "id": "H4VXhpCt",
        "kind": "retry_rate",
        "label": "Receive link rate",
        "value": 54,
        "unit": "Mbps",
        "observedAt": "2026-05-29T21:32:22.118Z",
        "source": "probe"
      }
    ],
    "rawEventRefs": [
      "probe_wifi_2026-05-29T21:32:22.118Z"
    ],
    "detectedAt": "2026-05-29T21:32:22.118Z",
    "id": "f_probe_wifi_performance_lan_home_studio_imac",
    "status": "triage",
    "updatedAt": "2026-05-29T21:36:22.118Z",
    "rca": {
      "cause": "Severe airtime contention from co-channel interference",
      "confidence": 0.79,
      "summary": "Channel utilization is saturated with an elevated retry rate, the classic co-channel interference signature. An RF channel rebalance should relieve it.",
      "evidence": [
        {
          "signalId": "YHYTROnJ",
          "statement": "Channel airtime is saturated."
        },
        {
          "signalId": "H4VXhpCt",
          "statement": "High retry rate confirms contention rather than client-side issues."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:36:22.118Z"
    }
  },
  {
    "id": "f_meraki_connectivity_loss_N_warehouse_Q2YY_BBBB_2222",
    "vendor": "meraki",
    "orgId": "org_demo",
    "faultClass": "connectivity_loss",
    "severity": "low",
    "status": "resolved",
    "title": "Brief uplink flap on wh-ms-01",
    "summary": "wh-ms-01 lost cloud heartbeat for 90 seconds, then recovered on its own.",
    "network": {
      "id": "N_warehouse",
      "name": "Warehouse"
    },
    "device": {
      "id": "Q2YY-BBBB-2222",
      "name": "wh-ms-01",
      "model": "MS120-8",
      "vendor": "meraki"
    },
    "signals": [
      {
        "id": "_pOsdT1R",
        "kind": "uplink_down",
        "label": "Uplink down for",
        "value": 1.5,
        "unit": "min",
        "observedAt": "2026-05-29T21:04:22.119Z",
        "source": "meraki"
      }
    ],
    "rawEventRefs": [
      "sim_auto_resolved_meraki_connectivity_loss"
    ],
    "rca": {
      "cause": "Transient upstream route change; the uplink recovered without intervention.",
      "confidence": 0.55,
      "summary": "Outage shorter than the cloud heartbeat backoff window; no sustained client impact observed.",
      "evidence": [
        {
          "signalId": "_pOsdT1R",
          "statement": "Single short loss-of-contact event with no follow-up; the next poll showed the device back online."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T21:04:22.119Z"
    },
    "detectedAt": "2026-05-29T21:04:22.119Z",
    "updatedAt": "2026-05-29T21:08:22.119Z"
  },
  {
    "id": "f_probe_dhcp_dns_lan_branch_branch_laptop",
    "vendor": "probe",
    "orgId": "org_demo",
    "faultClass": "dhcp_dns",
    "severity": "low",
    "status": "resolved",
    "title": "Transient DNS resolution dip",
    "summary": "branch-laptop saw 2 of 10 lookups fail in one probe cycle, then recovered.",
    "network": {
      "id": "lan_branch",
      "name": "Branch LAN"
    },
    "device": {
      "id": "branch-laptop",
      "name": "branch-laptop",
      "model": "host probe",
      "vendor": "probe"
    },
    "signals": [
      {
        "id": "h2tLtsd4",
        "kind": "dns_resolution_failures",
        "label": "Failed DNS lookups",
        "value": 2,
        "observedAt": "2026-05-29T20:49:22.119Z",
        "source": "probe"
      }
    ],
    "rawEventRefs": [
      "sim_auto_resolved_probe_dhcp_dns"
    ],
    "rca": {
      "cause": "Upstream resolver hiccup; cleared on the next probe cycle.",
      "confidence": 0.55,
      "summary": "Only one cycle in the trailing window failed; below the sustained-failure threshold for a real outage.",
      "evidence": [
        {
          "signalId": "h2tLtsd4",
          "statement": "Two failures observed once, then five-out-of-five successes on the following cycle."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T20:49:22.119Z"
    },
    "detectedAt": "2026-05-29T20:49:22.119Z",
    "updatedAt": "2026-05-29T20:52:22.119Z"
  },
  {
    "id": "f_unifi_wifi_performance_site_mtnview_f4_e2_c6_10_22_0b",
    "vendor": "unifi",
    "orgId": "org_demo",
    "faultClass": "wifi_performance",
    "severity": "low",
    "status": "resolved",
    "title": "Brief Wi-Fi interference burst",
    "summary": "mtnview-u6-pro saw a 30-second airtime spike that cleared on the next sample.",
    "network": {
      "id": "site_mtnview",
      "name": "Mountain View Office"
    },
    "device": {
      "id": "f4:e2:c6:10:22:0b",
      "name": "mtnview-u6-pro",
      "model": "U6-Pro",
      "vendor": "unifi"
    },
    "signals": [
      {
        "id": "SrVHCWXW",
        "kind": "channel_utilization",
        "label": "Channel utilization",
        "value": 62,
        "unit": "%",
        "observedAt": "2026-05-29T20:34:22.119Z",
        "source": "unifi"
      }
    ],
    "rawEventRefs": [
      "sim_auto_resolved_unifi_wifi_performance"
    ],
    "rca": {
      "cause": "Transient neighboring-network interference; cleared on its own.",
      "confidence": 0.55,
      "summary": "Single-sample spike not followed by sustained degradation; associated clients held their connections.",
      "evidence": [
        {
          "signalId": "SrVHCWXW",
          "statement": "One elevated utilization sample, then a return to baseline; no client drops observed."
        }
      ],
      "generatedBy": "heuristic",
      "generatedAt": "2026-05-29T20:34:22.119Z"
    },
    "detectedAt": "2026-05-29T20:34:22.119Z",
    "updatedAt": "2026-05-29T20:37:22.119Z"
  }
]