{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:39.350Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-76aa7b7199d9768d62c83c99",
    "scope_type": "region",
    "scope_key": "region/478",
    "geography": "region/478",
    "title": "Regional disruption in region/478",
    "started_at": "2026-08-12T04:50:00.000Z",
    "last_observed_at": "2026-09-22T02:00:00.000Z",
    "status": "resolved",
    "classification": "UNKNOWN_DISRUPTION",
    "trajectory": "RESOLVED",
    "stress_score": 31,
    "confidence": 14,
    "event_count": 1,
    "affected_asns": [
      "AS22085"
    ],
    "affected_services": [],
    "affected_regions": [
      "478"
    ],
    "source_count": 1,
    "record_origin": "unrecorded",
    "first_seen": "2026-09-28T18:39:30.435Z",
    "updated_at": "2026-10-03T23:39:49.185Z"
  },
  "events": [
    {
      "id": "ise-1c68786862c11a3297fa8973",
      "entity_type": "asn",
      "entity_key": "AS28571",
      "geography": "478",
      "started_at": "2026-09-21T22:55:00.000Z",
      "last_observed_at": "2026-09-21T22:55:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 4.9406170948981325
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS28571"
      ],
      "affected_services": [],
      "affected_regions": [
        "478"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-10-02T17:30:13.041Z",
      "updated_at": "2026-10-03T23:50:36.892Z",
      "evidence": [
        {
          "event_id": "ise-1c68786862c11a3297fa8973",
          "stix_object_id": "incident--34f63d10-15f7-5699-c883-a60b01542010",
          "platform": "ioda",
          "observed_at": "2026-09-21T22:55:00.000Z",
          "name": "AS28571 -- São Paulo",
          "value": "geoasn/28571-478",
          "content_hash": "301c559ad92eb04a",
          "object_json": {
            "id": "incident--34f63d10-15f7-5699-c883-a60b01542010",
            "name": "AS28571 -- São Paulo",
            "type": "incident",
            "score": 87219.2033542977,
            "title": "AS28571 -- São Paulo",
            "value": "geoasn/28571-478",
            "method": "median",
            "location": "geoasn/28571-478",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1040089
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-1ff624574ab4feb9ea441476",
      "entity_type": "asn",
      "entity_key": "AS6762",
      "geography": "478",
      "started_at": "2026-09-18T12:55:00.000Z",
      "last_observed_at": "2026-09-18T12:55:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.759153070300238
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS6762"
      ],
      "affected_services": [],
      "affected_regions": [
        "478"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-30T09:06:34.826Z",
      "updated_at": "2026-10-03T23:50:35.477Z",
      "evidence": [
        {
          "event_id": "ise-1ff624574ab4feb9ea441476",
          "stix_object_id": "incident--d855f1d5-dd90-59b6-c6f5-338bc1a9b9c7",
          "platform": "ioda",
          "observed_at": "2026-09-18T12:55:00.000Z",
          "name": "SEABONE-NET -- São Paulo",
          "value": "geoasn/6762-478",
          "content_hash": "9d234d022b998627",
          "object_json": {
            "id": "incident--d855f1d5-dd90-59b6-c6f5-338bc1a9b9c7",
            "name": "SEABONE-NET -- São Paulo",
            "type": "incident",
            "score": 574317.8494623655,
            "title": "SEABONE-NET -- São Paulo",
            "value": "geoasn/6762-478",
            "method": "median",
            "location": "geoasn/6762-478",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1335289
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-b307bc8643be172552eb43ba",
      "entity_type": "asn",
      "entity_key": "AS28586",
      "geography": "478",
      "started_at": "2026-09-14T20:55:00.000Z",
      "last_observed_at": "2026-09-14T20:55:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.342974147748536
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS28586"
      ],
      "affected_services": [],
      "affected_regions": [
        "478"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-28T18:39:23.043Z",
      "updated_at": "2026-10-03T23:50:33.083Z",
      "evidence": [
        {
          "event_id": "ise-b307bc8643be172552eb43ba",
          "stix_object_id": "incident--9a75c1c6-030f-5c09-daa9-4e9aec901e5d",
          "platform": "ioda",
          "observed_at": "2026-09-14T20:55:00.000Z",
          "name": "AS28586 -- São Paulo",
          "value": "geoasn/28586-478",
          "content_hash": "b8d602dcf2a73b84",
          "object_json": {
            "id": "incident--9a75c1c6-030f-5c09-daa9-4e9aec901e5d",
            "name": "AS28586 -- São Paulo",
            "type": "incident",
            "score": 220278.53333333333,
            "title": "AS28586 -- São Paulo",
            "value": "geoasn/28586-478",
            "method": "median",
            "location": "geoasn/28586-478",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1652089
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-c057328193b3842648f436ee",
      "entity_type": "asn",
      "entity_key": "AS22085",
      "geography": "478",
      "started_at": "2026-09-22T02:00:00.000Z",
      "last_observed_at": "2026-09-22T02:00:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.ping-slash24.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.ping-slash24.score": 5.553019459903973
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS22085"
      ],
      "affected_services": [],
      "affected_regions": [
        "478"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-10-03T17:16:28.384Z",
      "updated_at": "2026-10-03T23:50:37.149Z",
      "evidence": [
        {
          "event_id": "ise-c057328193b3842648f436ee",
          "stix_object_id": "incident--1bdfe98b-a0e4-53cf-016d-8b49c8748483",
          "platform": "ioda",
          "observed_at": "2026-09-22T02:00:00.000Z",
          "name": "AS22085 -- São Paulo",
          "value": "geoasn/22085-478",
          "content_hash": "a43b853b78c3627a",
          "object_json": {
            "id": "incident--1bdfe98b-a0e4-53cf-016d-8b49c8748483",
            "name": "AS22085 -- São Paulo",
            "type": "incident",
            "score": 357287.84722222225,
            "title": "AS22085 -- São Paulo",
            "value": "geoasn/22085-478",
            "method": "median",
            "location": "geoasn/22085-478",
            "datasource": "ping-slash24",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1028989
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-d10e895ddbb8aee4ee5528b6",
      "entity_type": "asn",
      "entity_key": "AS265303",
      "geography": "478",
      "started_at": "2026-09-15T10:00:00.000Z",
      "last_observed_at": "2026-09-15T10:00:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 6.115010137053502
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS265303"
      ],
      "affected_services": [],
      "affected_regions": [
        "478"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-29T17:36:22.369Z",
      "updated_at": "2026-10-03T23:50:33.373Z",
      "evidence": [
        {
          "event_id": "ise-d10e895ddbb8aee4ee5528b6",
          "stix_object_id": "incident--116995f8-2e38-563b-72c8-df3cbdc2b92a",
          "platform": "ioda",
          "observed_at": "2026-09-15T10:00:00.000Z",
          "name": "AS265303 -- São Paulo",
          "value": "geoasn/265303-478",
          "content_hash": "afe81744946f1127",
          "object_json": {
            "id": "incident--116995f8-2e38-563b-72c8-df3cbdc2b92a",
            "name": "AS265303 -- São Paulo",
            "type": "incident",
            "score": 1303196.1965811965,
            "title": "AS265303 -- São Paulo",
            "value": "geoasn/265303-478",
            "method": "median",
            "location": "geoasn/265303-478",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1604989
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-8ad2d33e4e6a8f63401a4270",
      "entity_type": "asn",
      "entity_key": "AS265303",
      "geography": null,
      "started_at": "2026-09-15T04:15:00.000Z",
      "last_observed_at": "2026-09-15T04:15:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 30,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.318944948182922
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS265303"
      ],
      "affected_services": [],
      "affected_regions": [],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "ambiguous geography",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-29T01:33:01.795Z",
      "updated_at": "2026-10-03T23:50:33.111Z",
      "evidence": [
        {
          "event_id": "ise-8ad2d33e4e6a8f63401a4270",
          "stix_object_id": "incident--f1bb970f-cf08-54ee-05aa-d6dba2d8bb3b",
          "platform": "ioda",
          "observed_at": "2026-09-15T04:15:00.000Z",
          "name": "AS265303 ()",
          "value": "asn/265303",
          "content_hash": "b309ce2194c93129",
          "object_json": {
            "id": "incident--f1bb970f-cf08-54ee-05aa-d6dba2d8bb3b",
            "name": "AS265303 ()",
            "type": "incident",
            "score": 208421.66666666666,
            "title": "AS265303 ()",
            "value": "asn/265303",
            "method": "median",
            "location": "asn/265303",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1625689
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-c3ba5b525246109f51b7ed90",
      "entity_type": "asn",
      "entity_key": "AS28571",
      "geography": null,
      "started_at": "2026-09-21T22:55:00.000Z",
      "last_observed_at": "2026-09-21T22:55:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 30,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 4.9406170948981325
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS28571"
      ],
      "affected_services": [],
      "affected_regions": [],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "ambiguous geography",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-10-02T17:08:16.813Z",
      "updated_at": "2026-10-03T23:50:36.903Z",
      "evidence": [
        {
          "event_id": "ise-c3ba5b525246109f51b7ed90",
          "stix_object_id": "incident--7a4bf709-b17d-5033-a96d-1f676c62487c",
          "platform": "ioda",
          "observed_at": "2026-09-21T22:55:00.000Z",
          "name": "AS28571 ()",
          "value": "asn/28571",
          "content_hash": "af91eaa29ec6aa9a",
          "object_json": {
            "id": "incident--7a4bf709-b17d-5033-a96d-1f676c62487c",
            "name": "AS28571 ()",
            "type": "incident",
            "score": 87219.2033542977,
            "title": "AS28571 ()",
            "value": "asn/28571",
            "method": "median",
            "location": "asn/28571",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1040089
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-e7dd4c1b9b393dc595840c1a",
      "entity_type": "asn",
      "entity_key": "AS28586",
      "geography": null,
      "started_at": "2026-08-12T04:50:00.000Z",
      "last_observed_at": "2026-08-12T04:50:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 30,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.078820149001543
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS28586"
      ],
      "affected_services": [],
      "affected_regions": [],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "ambiguous geography",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:23.264Z",
      "updated_at": "2026-10-03T23:50:23.023Z",
      "evidence": [
        {
          "event_id": "ise-e7dd4c1b9b393dc595840c1a",
          "stix_object_id": "incident--bfaa1776-7657-5176-2830-001e8299ef0e",
          "platform": "ioda",
          "observed_at": "2026-08-12T04:50:00.000Z",
          "name": "AS28586 ()",
          "value": "asn/28586",
          "content_hash": "5ae747a06807dd82",
          "object_json": {
            "id": "incident--bfaa1776-7657-5176-2830-001e8299ef0e",
            "name": "AS28586 ()",
            "type": "incident",
            "score": 119899.26666666666,
            "title": "AS28586 ()",
            "value": "asn/28586",
            "method": "median",
            "location": "asn/28586",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1798489
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--34f63d10-15f7-5699-c883-a60b01542010",
      "incident--d855f1d5-dd90-59b6-c6f5-338bc1a9b9c7",
      "incident--9a75c1c6-030f-5c09-daa9-4e9aec901e5d",
      "incident--1bdfe98b-a0e4-53cf-016d-8b49c8748483",
      "incident--116995f8-2e38-563b-72c8-df3cbdc2b92a",
      "incident--f1bb970f-cf08-54ee-05aa-d6dba2d8bb3b",
      "incident--7a4bf709-b17d-5033-a96d-1f676c62487c",
      "incident--bfaa1776-7657-5176-2830-001e8299ef0e"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}