{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:41.186Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-1510449448b77324afa636b2",
    "scope_type": "country",
    "scope_key": "SY",
    "geography": "SY",
    "title": "Internet disruption in SY",
    "started_at": "2026-08-10T10:30:00.000Z",
    "last_observed_at": "2026-10-01T11:40:00.000Z",
    "status": "resolved",
    "classification": "PARTIAL_OUTAGE",
    "trajectory": "RESOLVED",
    "stress_score": 65,
    "confidence": 34,
    "event_count": 1,
    "affected_asns": [
      "AS29256"
    ],
    "affected_services": [
      "Tor",
      "Facebook Messenger",
      "TikTok",
      "Signal"
    ],
    "affected_regions": [
      "SY"
    ],
    "source_count": 1,
    "record_origin": "unrecorded",
    "first_seen": "2026-08-29T22:33:33.032Z",
    "updated_at": "2026-10-03T23:39:45.120Z"
  },
  "events": [
    {
      "id": "ise-6f36f04eddaa227a13c8f934",
      "entity_type": "country",
      "entity_key": "SY",
      "geography": "SY",
      "started_at": "2026-08-10T10:30:00.000Z",
      "last_observed_at": "2026-10-01T11:40:00.000Z",
      "status": "resolved",
      "classification": "SERVICE_BLOCKING",
      "trajectory": "RESOLVED",
      "stress_score": 65,
      "confidence": 15,
      "components": {
        "anomaly": 1,
        "breadth": 0.3066666666666667,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 0.8958323851841339
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.5,
        "statistical_significance": 1
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.018018018018018018
      },
      "deviation": {
        "max_anomaly": 1,
        "max_deviation": 0.8958323851841339
      },
      "affected_asns": [
        "AS29256"
      ],
      "affected_services": [
        "Tor",
        "Facebook Messenger",
        "TikTok",
        "Signal"
      ],
      "affected_regions": [
        "SY"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "insufficient corroboration"
      ],
      "observation_count": 14,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:21.093Z",
      "updated_at": "2026-10-03T23:50:20.957Z",
      "evidence": [
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--b042a13a-9bee-5e4a-de98-eebbdbeb073d",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-10T10:30:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0838",
          "content_hash": "f88ba7aa87be298f",
          "object_json": {
            "id": "incident--b042a13a-9bee-5e4a-de98-eebbdbeb073d",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0838",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-08-10T23:35:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-08-10T10:30:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 3 critical alerts recorded.",
            "anomaly_rate": 0.1041676148158661,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--a39daef2-f06d-5abb-fbe8-c3c94f714b28",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-11T00:00:00.000Z",
          "name": "Censorship detected in SY",
          "value": "sy-2026-0840",
          "content_hash": "a9a477b47bd8a292",
          "object_json": {
            "id": "incident--a39daef2-f06d-5abb-fbe8-c3c94f714b28",
            "name": "Censorship detected in SY",
            "type": "incident",
            "title": "Censorship detected in SY",
            "value": "sy-2026-0840",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-08-11T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-08-11T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": [
              "Tor"
            ]
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--95e7973e-e0b3-5fb6-9929-dd5d6025b596",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-11T02:20:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0839",
          "content_hash": "c322f2e66cbf64dc",
          "object_json": {
            "id": "incident--95e7973e-e0b3-5fb6-9929-dd5d6025b596",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0839",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-08-11T19:50:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-08-11T02:20:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 2 critical alerts recorded.",
            "anomaly_rate": 0.2169811320754717,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--1ca9d93a-68d5-51df-3780-df230e98494a",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-13T10:50:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0841",
          "content_hash": "4596bce9d56d4cb4",
          "object_json": {
            "id": "incident--1ca9d93a-68d5-51df-3780-df230e98494a",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0841",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-08-13T13:05:00Z",
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-13T10:50:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 1 critical alerts recorded.",
            "anomaly_rate": 0.010872848082150407,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--a4d27075-3d0b-5776-72fb-cf5597b870f3",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-27T13:45:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0850",
          "content_hash": "b8abf71d9b5b5ddd",
          "object_json": {
            "id": "incident--a4d27075-3d0b-5776-72fb-cf5597b870f3",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0850",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-27T13:45:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 1 critical alerts recorded.",
            "anomaly_rate": 0.01058361052313275,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--1c463fc0-722e-5cc4-5e97-e0e030d4064c",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-29T19:05:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0851",
          "content_hash": "3d34ef1c95996ab3",
          "object_json": {
            "id": "incident--1c463fc0-722e-5cc4-5e97-e0e030d4064c",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0851",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-29T19:05:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 1 critical alerts recorded.",
            "anomaly_rate": 0.05,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--d4b09f4d-c01e-591b-33e6-c23a18a3b069",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-23T00:00:00.000Z",
          "name": "Censorship detected in SY",
          "value": "sy-2026-0881",
          "content_hash": "f9a01718e8f092c2",
          "object_json": {
            "id": "incident--d4b09f4d-c01e-591b-33e6-c23a18a3b069",
            "name": "Censorship detected in SY",
            "type": "incident",
            "title": "Censorship detected in SY",
            "value": "sy-2026-0881",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-23T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-09-23T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": [
              "Facebook Messenger"
            ]
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--220d5cfd-43ec-55f2-8965-db0200f54330",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-23T12:25:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0880",
          "content_hash": "ce915109647323b8",
          "object_json": {
            "id": "incident--220d5cfd-43ec-55f2-8965-db0200f54330",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0880",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-23T13:45:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-23T12:25:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 2 critical alerts recorded.",
            "anomaly_rate": 0.05,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 1.3333,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--e38055a1-ac40-5eae-73a9-8673097221de",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-27T00:00:00.000Z",
          "name": "Censorship detected in SY",
          "value": "sy-2026-0883",
          "content_hash": "914267ed6c47d24d",
          "object_json": {
            "id": "incident--e38055a1-ac40-5eae-73a9-8673097221de",
            "name": "Censorship detected in SY",
            "type": "incident",
            "title": "Censorship detected in SY",
            "value": "sy-2026-0883",
            "status": "suspected",
            "sources": [
              "ooni",
              "censoredplanet"
            ],
            "end_time": "2026-09-27T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-09-27T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [
              "AS29256"
            ],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [
              "tiktok.com"
            ],
            "affected_services": [
              "TikTok",
              "Tor"
            ]
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--82c4f9d8-dde7-5b92-ade9-6c3b97ced511",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-27T20:55:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0882",
          "content_hash": "5da9e215d1e5409a",
          "object_json": {
            "id": "incident--82c4f9d8-dde7-5b92-ade9-6c3b97ced511",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0882",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-27T20:55:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 1 critical alerts recorded.",
            "anomaly_rate": 0.05,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--db72bce6-03cf-54a6-8a53-f0406f03c089",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-28T00:00:00.000Z",
          "name": "Censorship detected in SY",
          "value": "sy-2026-0885",
          "content_hash": "69db25f9f3199fcf",
          "object_json": {
            "id": "incident--db72bce6-03cf-54a6-8a53-f0406f03c089",
            "name": "Censorship detected in SY",
            "type": "incident",
            "title": "Censorship detected in SY",
            "value": "sy-2026-0885",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-28T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-09-28T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": [
              "Signal",
              "Tor"
            ]
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--a0b18b48-24ae-5277-f9a6-8a220ab6e8f9",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-28T11:10:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0884",
          "content_hash": "d3eb630306b4fa07",
          "object_json": {
            "id": "incident--a0b18b48-24ae-5277-f9a6-8a220ab6e8f9",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0884",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-28T11:10:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 3 critical alerts recorded.",
            "anomaly_rate": 0.027986345007621604,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--3b731122-bdf2-53b2-58e2-9668700cc7d4",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-30T09:50:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0886",
          "content_hash": "544959a562d6860e",
          "object_json": {
            "id": "incident--3b731122-bdf2-53b2-58e2-9668700cc7d4",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0886",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-30T11:40:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-30T09:50:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 2 critical alerts recorded.",
            "anomaly_rate": 0.018018018018018018,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-6f36f04eddaa227a13c8f934",
          "stix_object_id": "incident--05a7be5e-e4fa-551d-0163-a2f2d3aba4f4",
          "platform": "voidly-atlas",
          "observed_at": "2026-10-01T11:40:00.000Z",
          "name": "Internet connectivity disruption in Syria",
          "value": "sy-2026-0887",
          "content_hash": "d6305d56e2fc8db2",
          "object_json": {
            "id": "incident--05a7be5e-e4fa-551d-0163-a2f2d3aba4f4",
            "name": "Internet connectivity disruption in Syria",
            "type": "incident",
            "title": "Internet connectivity disruption in Syria",
            "value": "sy-2026-0887",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-10-01T13:45:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-10-01T11:40:00Z",
            "description": "IODA detected significant connectivity drop in Syria. 3 critical alerts recorded.",
            "anomaly_rate": 0.018018018018018018,
            "country_code": "SY",
            "country_name": "Syria",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--b042a13a-9bee-5e4a-de98-eebbdbeb073d",
      "incident--a39daef2-f06d-5abb-fbe8-c3c94f714b28",
      "incident--95e7973e-e0b3-5fb6-9929-dd5d6025b596",
      "incident--1ca9d93a-68d5-51df-3780-df230e98494a",
      "incident--a4d27075-3d0b-5776-72fb-cf5597b870f3",
      "incident--1c463fc0-722e-5cc4-5e97-e0e030d4064c",
      "incident--d4b09f4d-c01e-591b-33e6-c23a18a3b069",
      "incident--220d5cfd-43ec-55f2-8965-db0200f54330",
      "incident--e38055a1-ac40-5eae-73a9-8673097221de",
      "incident--82c4f9d8-dde7-5b92-ade9-6c3b97ced511",
      "incident--db72bce6-03cf-54a6-8a53-f0406f03c089",
      "incident--a0b18b48-24ae-5277-f9a6-8a220ab6e8f9",
      "incident--3b731122-bdf2-53b2-58e2-9668700cc7d4",
      "incident--05a7be5e-e4fa-551d-0163-a2f2d3aba4f4"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}