{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:40.353Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-5b2d3fe03a793191d9f042a8",
    "scope_type": "country",
    "scope_key": "CU",
    "geography": "CU",
    "title": "Internet disruption in CU",
    "started_at": "2026-08-28T00:00:00.000Z",
    "last_observed_at": "2026-10-02T00:00:00.000Z",
    "status": "resolved",
    "classification": "APPLICATION_RESTRICTION",
    "trajectory": "RESOLVED",
    "stress_score": 37,
    "confidence": 17,
    "event_count": 1,
    "affected_asns": [
      "AS27725"
    ],
    "affected_services": [
      "Facebook Messenger",
      "Signal",
      "Telegram",
      "Tor",
      "WhatsApp",
      "Facebook",
      "Gemini",
      "Instagram",
      "YouTube"
    ],
    "affected_regions": [
      "CU"
    ],
    "source_count": 1,
    "record_origin": "unrecorded",
    "first_seen": "2026-08-29T22:33:35.340Z",
    "updated_at": "2026-10-03T23:39:47.012Z"
  },
  "events": [
    {
      "id": "ise-16af7c699aa67445914fe5b0",
      "entity_type": "country",
      "entity_key": "CU",
      "geography": "CU",
      "started_at": "2026-08-28T00:00:00.000Z",
      "last_observed_at": "2026-10-02T00:00:00.000Z",
      "status": "resolved",
      "classification": "APPLICATION_RESTRICTION",
      "trajectory": "RESOLVED",
      "stress_score": 37,
      "confidence": 0,
      "components": {
        "anomaly": 0.11241512657943258,
        "breadth": 0.44000000000000006,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 0.6666666666666666
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0.11241512657943258
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.951048951048951
      },
      "deviation": {
        "max_anomaly": 0.11241512657943258,
        "max_deviation": 0.6666666666666666
      },
      "affected_asns": [
        "AS27725"
      ],
      "affected_services": [
        "Facebook Messenger",
        "Signal",
        "Telegram",
        "Tor",
        "WhatsApp",
        "Facebook",
        "Gemini",
        "Instagram",
        "YouTube"
      ],
      "affected_regions": [
        "CU"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration"
      ],
      "observation_count": 10,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:27.281Z",
      "updated_at": "2026-10-03T23:50:27.743Z",
      "evidence": [
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--91cb7e48-90b9-564b-41b3-c8433e9765e4",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-28T00:00:00.000Z",
          "name": "Censorship detected in CU",
          "value": "cu-2026-0593",
          "content_hash": "3323b62660876813",
          "object_json": {
            "id": "incident--91cb7e48-90b9-564b-41b3-c8433e9765e4",
            "name": "Censorship detected in CU",
            "type": "incident",
            "title": "Censorship detected in CU",
            "value": "cu-2026-0593",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-08-28T23:59:59Z",
            "severity": "critical",
            "confidence": 77,
            "start_time": "2026-08-28T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.6666666666666666,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": 23.9997,
            "affected_domains": [],
            "affected_services": [
              "Facebook Messenger"
            ]
          }
        },
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--33b5394a-0d07-58d7-f0b2-70f7748e2fd6",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-29T00:00:00.000Z",
          "name": "Censorship detected in CU",
          "value": "cu-2026-0594",
          "content_hash": "920e6aabffd68ad8",
          "object_json": {
            "id": "incident--33b5394a-0d07-58d7-f0b2-70f7748e2fd6",
            "name": "Censorship detected in CU",
            "type": "incident",
            "title": "Censorship detected in CU",
            "value": "cu-2026-0594",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-08-29T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-08-29T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": 23.9997,
            "affected_domains": [],
            "affected_services": [
              "Facebook Messenger",
              "Signal",
              "Telegram",
              "Tor"
            ]
          }
        },
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--fa1bc3cc-713e-5784-97f5-d231a0db4c1b",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-23T00:00:00.000Z",
          "name": "Censorship detected in CU",
          "value": "cu-2026-0613",
          "content_hash": "579d770fed63b3be",
          "object_json": {
            "id": "incident--fa1bc3cc-713e-5784-97f5-d231a0db4c1b",
            "name": "Censorship detected in CU",
            "type": "incident",
            "title": "Censorship detected in CU",
            "value": "cu-2026-0613",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-23T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-09-23T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": [
              "Facebook Messenger",
              "WhatsApp"
            ]
          }
        },
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--de58a8b2-1f71-582c-2134-74991dc4b05c",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-25T00:00:00.000Z",
          "name": "Censorship detected in CU",
          "value": "cu-2026-0614",
          "content_hash": "c3561f07868902b7",
          "object_json": {
            "id": "incident--de58a8b2-1f71-582c-2134-74991dc4b05c",
            "name": "Censorship detected in CU",
            "type": "incident",
            "title": "Censorship detected in CU",
            "value": "cu-2026-0614",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-25T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-09-25T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": 23.9997,
            "affected_domains": [],
            "affected_services": [
              "Facebook Messenger",
              "Signal",
              "Telegram",
              "WhatsApp"
            ]
          }
        },
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--741faa84-996f-5934-3853-992040e83cec",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-26T00:00:00.000Z",
          "name": "Censorship detected in CU",
          "value": "cu-2026-0615",
          "content_hash": "309c8d5a66072cbe",
          "object_json": {
            "id": "incident--741faa84-996f-5934-3853-992040e83cec",
            "name": "Censorship detected in CU",
            "type": "incident",
            "title": "Censorship detected in CU",
            "value": "cu-2026-0615",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-26T23:59:59Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-09-26T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.5,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": [
              "Facebook Messenger"
            ]
          }
        },
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--4a22c7a8-a2c0-586e-4699-a974ab36cb8f",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-27T00:00:00.000Z",
          "name": "Internet censorship detected in Cuba",
          "value": "cu-2026-0617",
          "content_hash": "c2ff1deca9ffa516",
          "object_json": {
            "id": "incident--4a22c7a8-a2c0-586e-4699-a974ab36cb8f",
            "name": "Internet censorship detected in Cuba",
            "type": "incident",
            "title": "Internet censorship detected in Cuba",
            "value": "cu-2026-0617",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-27T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 2/2 probes anomalous (100.0%) for facebook.com.",
            "anomaly_rate": 0.01,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [
              "AS27725"
            ],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [
              "facebook.com",
              "gemini.google.com",
              "getlantern.org",
              "google.com",
              "instagram.com",
              "medium.com",
              "signal.org",
              "telegram.org",
              "tumblr.com",
              "whatsapp.com",
              "youtube.com"
            ],
            "affected_services": [
              "Facebook",
              "Gemini",
              "Instagram",
              "Signal",
              "Telegram",
              "WhatsApp",
              "YouTube"
            ]
          }
        },
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--4062e72c-05eb-5d7f-e9d9-4c31d8209dbd",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-28T00:00:00.000Z",
          "name": "Censorship detected in CU",
          "value": "cu-2026-0618",
          "content_hash": "f2193fcc6909f7b8",
          "object_json": {
            "id": "incident--4062e72c-05eb-5d7f-e9d9-4c31d8209dbd",
            "name": "Censorship detected in CU",
            "type": "incident",
            "title": "Censorship detected in CU",
            "value": "cu-2026-0618",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-28T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-09-28T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": [
              "Facebook Messenger",
              "Signal",
              "Telegram",
              "Tor"
            ]
          }
        },
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--7634dd6d-e745-5368-9b37-ddfab7b2330f",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-29T00:00:00.000Z",
          "name": "Censorship detected in CU",
          "value": "cu-2026-0619",
          "content_hash": "a5aec2e3e1cfdea3",
          "object_json": {
            "id": "incident--7634dd6d-e745-5368-9b37-ddfab7b2330f",
            "name": "Censorship detected in CU",
            "type": "incident",
            "title": "Censorship detected in CU",
            "value": "cu-2026-0619",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-29T23:59:59Z",
            "severity": "critical",
            "confidence": 90,
            "start_time": "2026-09-29T00:00:00Z",
            "description": null,
            "anomaly_rate": 1,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": [
              "Facebook Messenger",
              "Telegram"
            ]
          }
        },
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--a4bd96f4-76a4-5655-541a-daa5b960ab1a",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-30T00:00:00.000Z",
          "name": "Internet censorship detected in Cuba",
          "value": "cu-2026-0621",
          "content_hash": "f1e16955b1c1268f",
          "object_json": {
            "id": "incident--a4bd96f4-76a4-5655-541a-daa5b960ab1a",
            "name": "Internet censorship detected in Cuba",
            "type": "incident",
            "title": "Internet censorship detected in Cuba",
            "value": "cu-2026-0621",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-30T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 2/2 probes anomalous (100.0%) for facebook.com.",
            "anomaly_rate": 0.01,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [
              "AS27725"
            ],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [
              "facebook.com",
              "gemini.google.com",
              "getlantern.org",
              "google.com",
              "instagram.com",
              "medium.com",
              "signal.org",
              "telegram.org",
              "whatsapp.com",
              "youtube.com"
            ],
            "affected_services": [
              "Facebook",
              "Gemini",
              "Instagram",
              "Signal",
              "Telegram",
              "WhatsApp",
              "YouTube"
            ]
          }
        },
        {
          "event_id": "ise-16af7c699aa67445914fe5b0",
          "stix_object_id": "incident--3dd95d85-98d9-5c3c-f092-a5a5c835651e",
          "platform": "voidly-atlas",
          "observed_at": "2026-10-02T00:00:00.000Z",
          "name": "Censorship detected in CU",
          "value": "cu-2026-0622",
          "content_hash": "65453245e51d515a",
          "object_json": {
            "id": "incident--3dd95d85-98d9-5c3c-f092-a5a5c835651e",
            "name": "Censorship detected in CU",
            "type": "incident",
            "title": "Censorship detected in CU",
            "value": "cu-2026-0622",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-10-02T23:59:59Z",
            "severity": "critical",
            "confidence": 88,
            "start_time": "2026-10-02T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.951048951048951,
            "country_code": "CU",
            "country_name": "Cuba",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--91cb7e48-90b9-564b-41b3-c8433e9765e4",
      "incident--33b5394a-0d07-58d7-f0b2-70f7748e2fd6",
      "incident--fa1bc3cc-713e-5784-97f5-d231a0db4c1b",
      "incident--de58a8b2-1f71-582c-2134-74991dc4b05c",
      "incident--741faa84-996f-5934-3853-992040e83cec",
      "incident--4a22c7a8-a2c0-586e-4699-a974ab36cb8f",
      "incident--4062e72c-05eb-5d7f-e9d9-4c31d8209dbd",
      "incident--7634dd6d-e745-5368-9b37-ddfab7b2330f",
      "incident--a4bd96f4-76a4-5655-541a-daa5b960ab1a",
      "incident--3dd95d85-98d9-5c3c-f092-a5a5c835651e"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}