{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:39.522Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-a8204b4d629e6cb0d92f2b30",
    "scope_type": "country",
    "scope_key": "MK",
    "geography": "MK",
    "title": "Internet disruption in MK",
    "started_at": "2026-08-26T07:50:00.000Z",
    "last_observed_at": "2026-10-01T06:30:00.000Z",
    "status": "resolved",
    "classification": "UNKNOWN_DISRUPTION",
    "trajectory": "RESOLVED",
    "stress_score": 32,
    "confidence": 23,
    "event_count": 1,
    "affected_asns": [],
    "affected_services": [],
    "affected_regions": [
      "MK"
    ],
    "source_count": 1,
    "record_origin": "unrecorded",
    "first_seen": "2026-08-29T22:33:35.197Z",
    "updated_at": "2026-10-03T23:39:46.882Z"
  },
  "events": [
    {
      "id": "ise-e2e8232553224f076b2eeade",
      "entity_type": "country",
      "entity_key": "MK",
      "geography": "MK",
      "started_at": "2026-08-26T07:50:00.000Z",
      "last_observed_at": "2026-10-01T06:30:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 32,
      "confidence": 4,
      "components": {
        "anomaly": 0.43947977672381566,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 0.1997555639980578
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.5,
        "statistical_significance": 0.43947977672381566
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.21969696969696972
      },
      "deviation": {
        "max_anomaly": 0.43947977672381566,
        "max_deviation": 0.1997555639980578
      },
      "affected_asns": [],
      "affected_services": [],
      "affected_regions": [
        "MK"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "insufficient corroboration"
      ],
      "observation_count": 11,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:27.042Z",
      "updated_at": "2026-10-03T23:50:27.414Z",
      "evidence": [
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--2943728a-805c-50e7-c04f-2b8e292af5c4",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-26T07:50:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0050",
          "content_hash": "5ebfcfd1da710b57",
          "object_json": {
            "id": "incident--2943728a-805c-50e7-c04f-2b8e292af5c4",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0050",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-26T07:50:00Z",
            "description": "IODA detected significant connectivity drop in MK. 1 critical alerts recorded.",
            "anomaly_rate": 0.12422360248447205,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--5f0b3b93-b42e-55e3-3201-d77f729cf9cb",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-22T19:10:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0056",
          "content_hash": "7c2b5ee0677c59b0",
          "object_json": {
            "id": "incident--5f0b3b93-b42e-55e3-3201-d77f729cf9cb",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0056",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-22T19:10:00Z",
            "description": "IODA detected significant connectivity drop in MK. 1 critical alerts recorded.",
            "anomaly_rate": 0.22641509433962265,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--39f597dd-d0ca-578c-e53b-584fcd9ebf58",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-23T23:40:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0057",
          "content_hash": "e08151bee32b748f",
          "object_json": {
            "id": "incident--39f597dd-d0ca-578c-e53b-584fcd9ebf58",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0057",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-23T23:40:00Z",
            "description": "IODA detected significant connectivity drop in MK. 4 critical alerts recorded.",
            "anomaly_rate": 0.37507491241010515,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--2d3dd9e7-1d7f-5da4-15bf-54f3265f82f4",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-24T01:20:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0058",
          "content_hash": "3b975896dd4875c5",
          "object_json": {
            "id": "incident--2d3dd9e7-1d7f-5da4-15bf-54f3265f82f4",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0058",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-24T23:50:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-24T01:20:00Z",
            "description": "IODA detected significant connectivity drop in MK. 2 critical alerts recorded.",
            "anomaly_rate": 0.2413793103448276,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 22.5,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--f31efcc2-a70b-5bfb-93b8-ccd37d2d186c",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-25T02:20:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0059",
          "content_hash": "d5fc0a54d303d927",
          "object_json": {
            "id": "incident--f31efcc2-a70b-5bfb-93b8-ccd37d2d186c",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0059",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-25T22:20:00Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-09-25T02:20:00Z",
            "description": "IODA detected significant connectivity drop in MK. 5 critical alerts recorded.",
            "anomaly_rate": 0.23192104231974922,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 20,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--d328a46f-ea0c-5022-0ad1-27b28be3e8e7",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-26T01:30:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0060",
          "content_hash": "4e42f9cb85dcb3c7",
          "object_json": {
            "id": "incident--d328a46f-ea0c-5022-0ad1-27b28be3e8e7",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0060",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-26T22:00:00Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-09-26T01:30:00Z",
            "description": "IODA detected significant connectivity drop in MK. 5 critical alerts recorded.",
            "anomaly_rate": 0.20192349997250178,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 20.5,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--6b1dd3fd-06b3-5294-b3ee-4c2e08b4e264",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-27T01:40:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0061",
          "content_hash": "f88ba14725b1be6e",
          "object_json": {
            "id": "incident--6b1dd3fd-06b3-5294-b3ee-4c2e08b4e264",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0061",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-27T23:50:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-27T01:40:00Z",
            "description": "IODA detected significant connectivity drop in MK. 4 critical alerts recorded.",
            "anomaly_rate": 0.21434169278996867,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--4749547e-eb4e-5db4-f5a0-a2110a94508f",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-28T01:00:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0062",
          "content_hash": "dac21a828c26d074",
          "object_json": {
            "id": "incident--4749547e-eb4e-5db4-f5a0-a2110a94508f",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0062",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-28T18:00:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-28T01:00:00Z",
            "description": "IODA detected significant connectivity drop in MK. 3 critical alerts recorded.",
            "anomaly_rate": 0.23576280041797285,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--51b7409c-fb27-568f-dc63-a6996b068724",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-29T00:10:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0063",
          "content_hash": "a431ab9fc56fd42f",
          "object_json": {
            "id": "incident--51b7409c-fb27-568f-dc63-a6996b068724",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0063",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-29T21:10:00Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-09-29T00:10:00Z",
            "description": "IODA detected significant connectivity drop in MK. 6 critical alerts recorded.",
            "anomaly_rate": 0.2505224660397074,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--bc11b4b2-4984-5236-49d1-a1629cd366b5",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-30T05:10:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0064",
          "content_hash": "a1766c9b6e414f8f",
          "object_json": {
            "id": "incident--bc11b4b2-4984-5236-49d1-a1629cd366b5",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0064",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-30T06:15:00Z",
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-30T05:10:00Z",
            "description": "IODA detected significant connectivity drop in MK. 1 critical alerts recorded.",
            "anomaly_rate": 0.2159090909090909,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-e2e8232553224f076b2eeade",
          "stix_object_id": "incident--03ffa802-fc4f-5242-c1b8-ea420762dd37",
          "platform": "voidly-atlas",
          "observed_at": "2026-10-01T06:30:00.000Z",
          "name": "Internet connectivity disruption in MK",
          "value": "mk-2026-0065",
          "content_hash": "2f52398bf75a6b01",
          "object_json": {
            "id": "incident--03ffa802-fc4f-5242-c1b8-ea420762dd37",
            "name": "Internet connectivity disruption in MK",
            "type": "incident",
            "title": "Internet connectivity disruption in MK",
            "value": "mk-2026-0065",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-10-01T08:50:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-10-01T06:30:00Z",
            "description": "IODA detected significant connectivity drop in MK. 3 critical alerts recorded.",
            "anomaly_rate": 0.21969696969696972,
            "country_code": "MK",
            "country_name": "North Macedonia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--2943728a-805c-50e7-c04f-2b8e292af5c4",
      "incident--5f0b3b93-b42e-55e3-3201-d77f729cf9cb",
      "incident--39f597dd-d0ca-578c-e53b-584fcd9ebf58",
      "incident--2d3dd9e7-1d7f-5da4-15bf-54f3265f82f4",
      "incident--f31efcc2-a70b-5bfb-93b8-ccd37d2d186c",
      "incident--d328a46f-ea0c-5022-0ad1-27b28be3e8e7",
      "incident--6b1dd3fd-06b3-5294-b3ee-4c2e08b4e264",
      "incident--4749547e-eb4e-5db4-f5a0-a2110a94508f",
      "incident--51b7409c-fb27-568f-dc63-a6996b068724",
      "incident--bc11b4b2-4984-5236-49d1-a1629cd366b5",
      "incident--03ffa802-fc4f-5242-c1b8-ea420762dd37"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}