{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:57.330Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-37515d57a2719612a3253e7d",
    "scope_type": "country",
    "scope_key": "RS",
    "geography": "RS",
    "title": "Internet disruption in RS",
    "started_at": "2026-08-10T09:30:00.000Z",
    "last_observed_at": "2026-10-02T01:20:00.000Z",
    "status": "resolved",
    "classification": "UNKNOWN_DISRUPTION",
    "trajectory": "RESOLVED",
    "stress_score": 52,
    "confidence": 34,
    "event_count": 1,
    "affected_asns": [],
    "affected_services": [],
    "affected_regions": [
      "RS"
    ],
    "source_count": 1,
    "record_origin": "unrecorded",
    "first_seen": "2026-08-29T22:33:33.022Z",
    "updated_at": "2026-10-03T23:39:45.108Z"
  },
  "events": [
    {
      "id": "ise-0281f82f810622104d254b59",
      "entity_type": "country",
      "entity_key": "RS",
      "geography": "RS",
      "started_at": "2026-08-10T09:30:00.000Z",
      "last_observed_at": "2026-10-02T01:20:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 52,
      "confidence": 15,
      "components": {
        "anomaly": 1,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 0.42175222936102275
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.5,
        "statistical_significance": 1
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.14772727272727273
      },
      "deviation": {
        "max_anomaly": 1,
        "max_deviation": 0.42175222936102275
      },
      "affected_asns": [],
      "affected_services": [],
      "affected_regions": [
        "RS"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "insufficient corroboration"
      ],
      "observation_count": 11,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:20.917Z",
      "updated_at": "2026-10-03T23:50:20.806Z",
      "evidence": [
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--36fb3208-62e3-524d-eabb-bec297c09eb2",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-10T09:30:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0033",
          "content_hash": "4775ffaf70864067",
          "object_json": {
            "id": "incident--36fb3208-62e3-524d-eabb-bec297c09eb2",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0033",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-10T09:30:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 1 critical alerts recorded.",
            "anomaly_rate": 0.022727272727272728,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--f7c52e5f-5dc8-5460-985e-bf7c61aa8052",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-12T23:20:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0034",
          "content_hash": "dea009d29e62724f",
          "object_json": {
            "id": "incident--f7c52e5f-5dc8-5460-985e-bf7c61aa8052",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0034",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-12T23:20:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 1 critical alerts recorded.",
            "anomaly_rate": 0.037037037037037035,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--af2683e8-0df7-5130-aa56-79420b5d337e",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-26T10:15:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0042",
          "content_hash": "2a01065c47253c67",
          "object_json": {
            "id": "incident--af2683e8-0df7-5130-aa56-79420b5d337e",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0042",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-26T10:15:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 1 critical alerts recorded.",
            "anomaly_rate": 0.013333333333333334,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--4604a139-01fb-5d5c-97d6-13be02bc922c",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-27T08:35:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0043",
          "content_hash": "3aedeabb49650da7",
          "object_json": {
            "id": "incident--4604a139-01fb-5d5c-97d6-13be02bc922c",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0043",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-08-27T12:35:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-08-27T08:35:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 2 critical alerts recorded.",
            "anomaly_rate": 0.08,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 4,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--86be5d25-63c4-55d9-f5d5-a8508d39abf8",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-29T17:00:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0044",
          "content_hash": "c38166405544f89b",
          "object_json": {
            "id": "incident--86be5d25-63c4-55d9-f5d5-a8508d39abf8",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0044",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-29T17:00:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 1 critical alerts recorded.",
            "anomaly_rate": 0.037037037037037035,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--64b61320-d419-5155-8866-617892b362cc",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-24T07:30:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0055",
          "content_hash": "36e4feb32b78867a",
          "object_json": {
            "id": "incident--64b61320-d419-5155-8866-617892b362cc",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0055",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-24T09:25:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-24T07:30:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 2 critical alerts recorded.",
            "anomaly_rate": 0.04,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 1.9167,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--2355384e-7d77-5a54-3b0b-c6d1d255b7aa",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-25T22:40:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0056",
          "content_hash": "0d9cf582facaba59",
          "object_json": {
            "id": "incident--2355384e-7d77-5a54-3b0b-c6d1d255b7aa",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0056",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-25T22:40:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 1 critical alerts recorded.",
            "anomaly_rate": 0.21487603305785125,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--3c456a32-adb5-5015-f001-b9a83636fce0",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-30T20:40:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0057",
          "content_hash": "89001fa905389f1b",
          "object_json": {
            "id": "incident--3c456a32-adb5-5015-f001-b9a83636fce0",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0057",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-30T23:15:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-30T20:40:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 2 critical alerts recorded.",
            "anomaly_rate": 0.01921922255826365,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--cf3e82af-12fd-520a-0a03-db674f6d05d4",
          "platform": "voidly-atlas",
          "observed_at": "2026-10-01T11:30:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0058",
          "content_hash": "f1d6a202ec8a9adf",
          "object_json": {
            "id": "incident--cf3e82af-12fd-520a-0a03-db674f6d05d4",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0058",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-10-01T11:30:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 1 critical alerts recorded.",
            "anomaly_rate": 0.24,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--18b15e1c-6949-5ca6-cdf1-3ee715fe8cb4",
          "platform": "voidly-atlas",
          "observed_at": "2026-10-02T00:00:00.000Z",
          "name": "Censorship detected in RS",
          "value": "rs-2026-0060",
          "content_hash": "77a115c9605abc21",
          "object_json": {
            "id": "incident--18b15e1c-6949-5ca6-cdf1-3ee715fe8cb4",
            "name": "Censorship detected in RS",
            "type": "incident",
            "title": "Censorship detected in RS",
            "value": "rs-2026-0060",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-10-02T23:59:59Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-10-02T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.5,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-0281f82f810622104d254b59",
          "stix_object_id": "incident--54c03125-4624-59bc-a5a2-fd7181231011",
          "platform": "voidly-atlas",
          "observed_at": "2026-10-02T01:20:00.000Z",
          "name": "Internet connectivity disruption in Serbia",
          "value": "rs-2026-0059",
          "content_hash": "80431b7ef3b1e651",
          "object_json": {
            "id": "incident--54c03125-4624-59bc-a5a2-fd7181231011",
            "name": "Internet connectivity disruption in Serbia",
            "type": "incident",
            "title": "Internet connectivity disruption in Serbia",
            "value": "rs-2026-0059",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-10-02T01:20:00Z",
            "description": "IODA detected significant connectivity drop in Serbia. 1 critical alerts recorded.",
            "anomaly_rate": 0.14772727272727273,
            "country_code": "RS",
            "country_name": "Serbia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--36fb3208-62e3-524d-eabb-bec297c09eb2",
      "incident--f7c52e5f-5dc8-5460-985e-bf7c61aa8052",
      "incident--af2683e8-0df7-5130-aa56-79420b5d337e",
      "incident--4604a139-01fb-5d5c-97d6-13be02bc922c",
      "incident--86be5d25-63c4-55d9-f5d5-a8508d39abf8",
      "incident--64b61320-d419-5155-8866-617892b362cc",
      "incident--2355384e-7d77-5a54-3b0b-c6d1d255b7aa",
      "incident--3c456a32-adb5-5015-f001-b9a83636fce0",
      "incident--cf3e82af-12fd-520a-0a03-db674f6d05d4",
      "incident--18b15e1c-6949-5ca6-cdf1-3ee715fe8cb4",
      "incident--54c03125-4624-59bc-a5a2-fd7181231011"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}