{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:33.979Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-2b097471402a5db1bfcc2178",
    "scope_type": "country",
    "scope_key": "TN",
    "geography": "TN",
    "title": "Internet disruption in TN",
    "started_at": "2026-08-10T00:00:00.000Z",
    "last_observed_at": "2026-10-02T00:00:00.000Z",
    "status": "resolved",
    "classification": "UNKNOWN_DISRUPTION",
    "trajectory": "RESOLVED",
    "stress_score": 60,
    "confidence": 34,
    "event_count": 1,
    "affected_asns": [],
    "affected_services": [],
    "affected_regions": [
      "TN"
    ],
    "source_count": 1,
    "record_origin": "unrecorded",
    "first_seen": "2026-08-29T22:33:32.715Z",
    "updated_at": "2026-10-03T23:39:44.792Z"
  },
  "events": [
    {
      "id": "ise-162ce45283c676d7510fa417",
      "entity_type": "country",
      "entity_key": "TN",
      "geography": "TN",
      "started_at": "2026-08-10T00:00:00.000Z",
      "last_observed_at": "2026-10-02T00:00:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 60,
      "confidence": 15,
      "components": {
        "anomaly": 1,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.5,
        "statistical_significance": 1
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.6666666666666666
      },
      "deviation": {
        "max_anomaly": 1,
        "max_deviation": 1
      },
      "affected_asns": [],
      "affected_services": [],
      "affected_regions": [
        "TN"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "insufficient corroboration"
      ],
      "observation_count": 12,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:20.428Z",
      "updated_at": "2026-10-03T23:50:20.316Z",
      "evidence": [
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--d05fa1fb-7386-5523-e40c-1ad690ea2e7e",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-10T00:00:00.000Z",
          "name": "Censorship detected in TN",
          "value": "tn-2026-0552",
          "content_hash": "d8d734e487d1dd67",
          "object_json": {
            "id": "incident--d05fa1fb-7386-5523-e40c-1ad690ea2e7e",
            "name": "Censorship detected in TN",
            "type": "incident",
            "title": "Censorship detected in TN",
            "value": "tn-2026-0552",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-08-10T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-08-10T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--67f8fd76-8ae2-5c41-f8b3-b6a10cdb2824",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-12T00:00:00.000Z",
          "name": "Censorship detected in TN",
          "value": "tn-2026-0553",
          "content_hash": "e258d816cd358c0c",
          "object_json": {
            "id": "incident--67f8fd76-8ae2-5c41-f8b3-b6a10cdb2824",
            "name": "Censorship detected in TN",
            "type": "incident",
            "title": "Censorship detected in TN",
            "value": "tn-2026-0553",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-08-12T23:59:59Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-08-12T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.5,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--d0dc148d-1ba7-5ef7-33df-af0e187bebce",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-26T13:50:00.000Z",
          "name": "Internet connectivity disruption in Tunisia",
          "value": "tn-2026-0560",
          "content_hash": "44130fc3c669ea3d",
          "object_json": {
            "id": "incident--d0dc148d-1ba7-5ef7-33df-af0e187bebce",
            "name": "Internet connectivity disruption in Tunisia",
            "type": "incident",
            "title": "Internet connectivity disruption in Tunisia",
            "value": "tn-2026-0560",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-08-26T22:30:00Z",
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-26T13:50:00Z",
            "description": "IODA detected significant connectivity drop in Tunisia. 1 critical alerts recorded.",
            "anomaly_rate": 0.20930232558139536,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--ad84f987-19a5-5997-87c7-cf5decc776df",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-27T13:10:00.000Z",
          "name": "Internet connectivity disruption in Tunisia",
          "value": "tn-2026-0561",
          "content_hash": "95b9a1123d7aa569",
          "object_json": {
            "id": "incident--ad84f987-19a5-5997-87c7-cf5decc776df",
            "name": "Internet connectivity disruption in Tunisia",
            "type": "incident",
            "title": "Internet connectivity disruption in Tunisia",
            "value": "tn-2026-0561",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-08-27T23:40:00Z",
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-27T13:10:00Z",
            "description": "IODA detected significant connectivity drop in Tunisia. 1 critical alerts recorded.",
            "anomaly_rate": 0.21052631578947367,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 10.5,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--139de2b6-5651-57f8-4c1d-ce76bdf2e0fc",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-28T11:50:00.000Z",
          "name": "Internet connectivity disruption in Tunisia",
          "value": "tn-2026-0562",
          "content_hash": "8bd2f1d044842765",
          "object_json": {
            "id": "incident--139de2b6-5651-57f8-4c1d-ce76bdf2e0fc",
            "name": "Internet connectivity disruption in Tunisia",
            "type": "incident",
            "title": "Internet connectivity disruption in Tunisia",
            "value": "tn-2026-0562",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-28T11:50:00Z",
            "description": "IODA detected significant connectivity drop in Tunisia. 1 critical alerts recorded.",
            "anomaly_rate": 0.20088924818108328,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--070b95e5-e87e-558d-e0c2-d4041dcc1579",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-29T11:10:00.000Z",
          "name": "Internet connectivity disruption in Tunisia",
          "value": "tn-2026-0563",
          "content_hash": "575e04329ed904e1",
          "object_json": {
            "id": "incident--070b95e5-e87e-558d-e0c2-d4041dcc1579",
            "name": "Internet connectivity disruption in Tunisia",
            "type": "incident",
            "title": "Internet connectivity disruption in Tunisia",
            "value": "tn-2026-0563",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-08-29T11:50:00Z",
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-29T11:10:00Z",
            "description": "IODA detected significant connectivity drop in Tunisia. 1 critical alerts recorded.",
            "anomaly_rate": 0.2022365939099973,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0.6667,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--a41deb7f-6aad-52d4-2484-71d42a5662c0",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-23T00:00:00.000Z",
          "name": "Censorship detected in TN",
          "value": "tn-2026-0576",
          "content_hash": "d37d792f342ad0de",
          "object_json": {
            "id": "incident--a41deb7f-6aad-52d4-2484-71d42a5662c0",
            "name": "Censorship detected in TN",
            "type": "incident",
            "title": "Censorship detected in TN",
            "value": "tn-2026-0576",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-23T23:59:59Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-09-23T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.5,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--c8f0afc8-3756-5492-50b1-ed64d251d299",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-24T00:00:00.000Z",
          "name": "Censorship detected in TN",
          "value": "tn-2026-0577",
          "content_hash": "e73ec259fa57fb6f",
          "object_json": {
            "id": "incident--c8f0afc8-3756-5492-50b1-ed64d251d299",
            "name": "Censorship detected in TN",
            "type": "incident",
            "title": "Censorship detected in TN",
            "value": "tn-2026-0577",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-24T23:59:59Z",
            "severity": "critical",
            "confidence": 77,
            "start_time": "2026-09-24T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.6666666666666666,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": 23.9997,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--b6f0e385-eaa0-5e04-e780-688ccd208ac3",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-26T00:00:00.000Z",
          "name": "Censorship detected in TN",
          "value": "tn-2026-0578",
          "content_hash": "f890373d32648974",
          "object_json": {
            "id": "incident--b6f0e385-eaa0-5e04-e780-688ccd208ac3",
            "name": "Censorship detected in TN",
            "type": "incident",
            "title": "Censorship detected in TN",
            "value": "tn-2026-0578",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-26T23:59:59Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-09-26T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.5,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--684e8519-31c1-539a-e3e5-493ae161ce29",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-29T23:20:00.000Z",
          "name": "Internet connectivity disruption in Tunisia",
          "value": "tn-2026-0579",
          "content_hash": "e02a711e4b073da8",
          "object_json": {
            "id": "incident--684e8519-31c1-539a-e3e5-493ae161ce29",
            "name": "Internet connectivity disruption in Tunisia",
            "type": "incident",
            "title": "Internet connectivity disruption in Tunisia",
            "value": "tn-2026-0579",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-29T23:20:00Z",
            "description": "IODA detected significant connectivity drop in Tunisia. 1 critical alerts recorded.",
            "anomaly_rate": 0.21983243716393647,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--a913048e-e228-5b6c-b039-f62137a99b96",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-30T00:00:00.000Z",
          "name": "Censorship detected in TN",
          "value": "tn-2026-0580",
          "content_hash": "ae99b83395b4a8bd",
          "object_json": {
            "id": "incident--a913048e-e228-5b6c-b039-f62137a99b96",
            "name": "Censorship detected in TN",
            "type": "incident",
            "title": "Censorship detected in TN",
            "value": "tn-2026-0580",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-30T23:59:59Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-09-30T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.5,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-162ce45283c676d7510fa417",
          "stix_object_id": "incident--53358995-435e-5fa4-75cb-99159b67034c",
          "platform": "voidly-atlas",
          "observed_at": "2026-10-02T00:00:00.000Z",
          "name": "Censorship detected in TN",
          "value": "tn-2026-0581",
          "content_hash": "506c7a988472b11f",
          "object_json": {
            "id": "incident--53358995-435e-5fa4-75cb-99159b67034c",
            "name": "Censorship detected in TN",
            "type": "incident",
            "title": "Censorship detected in TN",
            "value": "tn-2026-0581",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-10-02T23:59:59Z",
            "severity": "critical",
            "confidence": 77,
            "start_time": "2026-10-02T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.6666666666666666,
            "country_code": "TN",
            "country_name": "Tunisia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--d05fa1fb-7386-5523-e40c-1ad690ea2e7e",
      "incident--67f8fd76-8ae2-5c41-f8b3-b6a10cdb2824",
      "incident--d0dc148d-1ba7-5ef7-33df-af0e187bebce",
      "incident--ad84f987-19a5-5997-87c7-cf5decc776df",
      "incident--139de2b6-5651-57f8-4c1d-ce76bdf2e0fc",
      "incident--070b95e5-e87e-558d-e0c2-d4041dcc1579",
      "incident--a41deb7f-6aad-52d4-2484-71d42a5662c0",
      "incident--c8f0afc8-3756-5492-50b1-ed64d251d299",
      "incident--b6f0e385-eaa0-5e04-e780-688ccd208ac3",
      "incident--684e8519-31c1-539a-e3e5-493ae161ce29",
      "incident--a913048e-e228-5b6c-b039-f62137a99b96",
      "incident--53358995-435e-5fa4-75cb-99159b67034c"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}