{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:40.752Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-9d30dabd432c523046542d43",
    "scope_type": "country",
    "scope_key": "CH",
    "geography": "CH",
    "title": "Internet disruption in CH",
    "started_at": "2026-09-08T10:00:00.000Z",
    "last_observed_at": "2026-09-29T05:25:00.000Z",
    "status": "resolved",
    "classification": "UNKNOWN_DISRUPTION",
    "trajectory": "RESOLVED",
    "stress_score": 31,
    "confidence": 46,
    "event_count": 5,
    "affected_asns": [
      "AS5398",
      "AS41913"
    ],
    "affected_services": [],
    "affected_regions": [
      "CH",
      "602"
    ],
    "source_count": 2,
    "record_origin": "unrecorded",
    "first_seen": "2026-09-26T10:52:20.490Z",
    "updated_at": "2026-10-03T23:39:47.378Z"
  },
  "events": [
    {
      "id": "ise-24a7f30a4f0002d30326d92c",
      "entity_type": "asn",
      "entity_key": "AS41913",
      "geography": "602",
      "started_at": "2026-09-20T02:00:00.000Z",
      "last_observed_at": "2026-09-20T02:00:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.171346132824267
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS41913"
      ],
      "affected_services": [],
      "affected_regions": [
        "602"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-10-01T07:36:57.656Z",
      "updated_at": "2026-10-03T23:50:35.746Z",
      "evidence": [
        {
          "event_id": "ise-24a7f30a4f0002d30326d92c",
          "stix_object_id": "incident--874f37cd-5f6a-5101-e9eb-96f9b17ddcf9",
          "platform": "ioda",
          "observed_at": "2026-09-20T02:00:00.000Z",
          "name": "COMPUTERLINE -- Zürich",
          "value": "geoasn/41913-602",
          "content_hash": "8a952d971dc4df0c",
          "object_json": {
            "id": "incident--874f37cd-5f6a-5101-e9eb-96f9b17ddcf9",
            "name": "COMPUTERLINE -- Zürich",
            "type": "incident",
            "score": 148369.012345679,
            "title": "COMPUTERLINE -- Zürich",
            "value": "geoasn/41913-602",
            "method": "median",
            "location": "geoasn/41913-602",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1201789
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-724cc58727591df22511fcce",
      "entity_type": "asn",
      "entity_key": "AS41913",
      "geography": "CH",
      "started_at": "2026-09-20T02:00:00.000Z",
      "last_observed_at": "2026-09-20T02:00:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.171346132824267
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS41913"
      ],
      "affected_services": [],
      "affected_regions": [
        "CH"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-10-01T07:47:59.773Z",
      "updated_at": "2026-10-03T23:50:35.755Z",
      "evidence": [
        {
          "event_id": "ise-724cc58727591df22511fcce",
          "stix_object_id": "incident--2e0e0b4a-d778-582c-addb-b6b28cb9a7ee",
          "platform": "ioda",
          "observed_at": "2026-09-20T02:00:00.000Z",
          "name": "COMPUTERLINE -- Switzerland",
          "value": "geoasn/41913-ch",
          "content_hash": "f6216680215e3c51",
          "object_json": {
            "id": "incident--2e0e0b4a-d778-582c-addb-b6b28cb9a7ee",
            "name": "COMPUTERLINE -- Switzerland",
            "type": "incident",
            "score": 148369.012345679,
            "title": "COMPUTERLINE -- Switzerland",
            "value": "geoasn/41913-ch",
            "method": "median",
            "location": "geoasn/41913-CH",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1201789
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-9d577008d8f80b228e46c3f1",
      "entity_type": "asn",
      "entity_key": "AS5398",
      "geography": "CH",
      "started_at": "2026-09-08T10:00:00.000Z",
      "last_observed_at": "2026-09-08T10:00:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.720854684570222
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS5398"
      ],
      "affected_services": [],
      "affected_regions": [
        "CH"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-26T10:52:03.573Z",
      "updated_at": "2026-10-03T23:50:28.920Z",
      "evidence": [
        {
          "event_id": "ise-9d577008d8f80b228e46c3f1",
          "stix_object_id": "incident--888de43f-0f12-5f65-9eb7-b0fcccacf180",
          "platform": "ioda",
          "observed_at": "2026-09-08T10:00:00.000Z",
          "name": "AS5398 -- Switzerland",
          "value": "geoasn/5398-ch",
          "content_hash": "4df4d3fe76ae61d7",
          "object_json": {
            "id": "incident--888de43f-0f12-5f65-9eb7-b0fcccacf180",
            "name": "AS5398 -- Switzerland",
            "type": "incident",
            "score": 525840.2898550724,
            "title": "AS5398 -- Switzerland",
            "value": "geoasn/5398-ch",
            "method": "median",
            "location": "geoasn/5398-CH",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1814149
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-e8438bf1219c3b51b0b4d6be",
      "entity_type": "asn",
      "entity_key": "AS41913",
      "geography": null,
      "started_at": "2026-09-20T02:00:00.000Z",
      "last_observed_at": "2026-09-20T02:00:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 30,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.097560460719338
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS41913"
      ],
      "affected_services": [],
      "affected_regions": [],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "ambiguous geography",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-10-01T04:41:35.702Z",
      "updated_at": "2026-10-03T23:50:35.765Z",
      "evidence": [
        {
          "event_id": "ise-e8438bf1219c3b51b0b4d6be",
          "stix_object_id": "incident--e6b3e05c-c2f4-5c19-8362-13269a846bb9",
          "platform": "ioda",
          "observed_at": "2026-09-20T02:00:00.000Z",
          "name": "AS41913 (COMPUTERLINE)",
          "value": "asn/41913",
          "content_hash": "f732885698e1840a",
          "object_json": {
            "id": "incident--e6b3e05c-c2f4-5c19-8362-13269a846bb9",
            "name": "AS41913 (COMPUTERLINE)",
            "type": "incident",
            "score": 125186.35416666666,
            "title": "AS41913 (COMPUTERLINE)",
            "value": "asn/41913",
            "method": "median",
            "location": "asn/41913",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1201789
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-2c07878682743827e3956456",
      "entity_type": "country",
      "entity_key": "CH",
      "geography": "CH",
      "started_at": "2026-09-23T06:25:00.000Z",
      "last_observed_at": "2026-09-29T05:25:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 16,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 0.017241379310344827
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.017241379310344827
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 0.017241379310344827
      },
      "affected_asns": [],
      "affected_services": [],
      "affected_regions": [
        "CH"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration"
      ],
      "observation_count": 2,
      "ingestion_method": null,
      "first_seen": "2026-09-26T10:52:07.746Z",
      "updated_at": "2026-10-03T23:50:37.249Z",
      "evidence": [
        {
          "event_id": "ise-2c07878682743827e3956456",
          "stix_object_id": "incident--6cc23ebf-851f-5233-7b1f-13c70df45893",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-23T06:25:00.000Z",
          "name": "Internet connectivity disruption in Switzerland",
          "value": "ch-2026-0013",
          "content_hash": "c221f3b6e6df8b36",
          "object_json": {
            "id": "incident--6cc23ebf-851f-5233-7b1f-13c70df45893",
            "name": "Internet connectivity disruption in Switzerland",
            "type": "incident",
            "title": "Internet connectivity disruption in Switzerland",
            "value": "ch-2026-0013",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-23T11:15:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-23T06:25:00Z",
            "description": "IODA detected significant connectivity drop in Switzerland. 2 critical alerts recorded.",
            "anomaly_rate": 0.017241379310344827,
            "country_code": "CH",
            "country_name": "Switzerland",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 4.8333,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-2c07878682743827e3956456",
          "stix_object_id": "incident--8a40b2cb-6af5-50ad-f751-efcfbd503bff",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-29T05:25:00.000Z",
          "name": "Internet connectivity disruption in Switzerland",
          "value": "ch-2026-0014",
          "content_hash": "36cc0bf261ce0153",
          "object_json": {
            "id": "incident--8a40b2cb-6af5-50ad-f751-efcfbd503bff",
            "name": "Internet connectivity disruption in Switzerland",
            "type": "incident",
            "title": "Internet connectivity disruption in Switzerland",
            "value": "ch-2026-0014",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-29T05:25:00Z",
            "description": "IODA detected significant connectivity drop in Switzerland. 1 critical alerts recorded.",
            "anomaly_rate": 0.017241379310344827,
            "country_code": "CH",
            "country_name": "Switzerland",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--874f37cd-5f6a-5101-e9eb-96f9b17ddcf9",
      "incident--2e0e0b4a-d778-582c-addb-b6b28cb9a7ee",
      "incident--888de43f-0f12-5f65-9eb7-b0fcccacf180",
      "incident--e6b3e05c-c2f4-5c19-8362-13269a846bb9",
      "incident--6cc23ebf-851f-5233-7b1f-13c70df45893",
      "incident--8a40b2cb-6af5-50ad-f751-efcfbd503bff"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}