{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:34.840Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-ad2f4b70894a628ba2b0d359",
    "scope_type": "country",
    "scope_key": "SA",
    "geography": "SA",
    "title": "Internet disruption in SA",
    "started_at": "2026-08-12T00:00:00.000Z",
    "last_observed_at": "2026-09-30T00:00:00.000Z",
    "status": "resolved",
    "classification": "APPLICATION_RESTRICTION",
    "trajectory": "RESOLVED",
    "stress_score": 31,
    "confidence": 43,
    "event_count": 4,
    "affected_asns": [
      "AS8895",
      "AS41132"
    ],
    "affected_services": [
      "ChatGPT",
      "Claude",
      "Facebook",
      "Gemini",
      "Instagram",
      "ProtonVPN",
      "Signal",
      "Telegram",
      "TikTok",
      "WhatsApp",
      "X",
      "YouTube"
    ],
    "affected_regions": [
      "SA",
      "3501"
    ],
    "source_count": 2,
    "record_origin": "unrecorded",
    "first_seen": "2026-08-29T22:33:33.771Z",
    "updated_at": "2026-10-03T23:39:45.771Z"
  },
  "events": [
    {
      "id": "ise-f15d783f70f63b7d1ab54f52",
      "entity_type": "asn",
      "entity_key": "AS41132",
      "geography": "3501",
      "started_at": "2026-09-20T08:25:00.000Z",
      "last_observed_at": "2026-09-20T08:25:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.895308524166799
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS41132"
      ],
      "affected_services": [],
      "affected_regions": [
        "3501"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-10-01T10:22:05.461Z",
      "updated_at": "2026-10-03T23:50:35.808Z",
      "evidence": [
        {
          "event_id": "ise-f15d783f70f63b7d1ab54f52",
          "stix_object_id": "incident--3cf16648-f154-5bb4-1b35-cf3f5b10d032",
          "platform": "ioda",
          "observed_at": "2026-09-20T08:25:00.000Z",
          "name": "sol-as -- Ar Riyad",
          "value": "geoasn/41132-3501",
          "content_hash": "d917150bd79446e1",
          "object_json": {
            "id": "incident--3cf16648-f154-5bb4-1b35-cf3f5b10d032",
            "name": "sol-as -- Ar Riyad",
            "type": "incident",
            "score": 785792.6666666666,
            "title": "sol-as -- Ar Riyad",
            "value": "geoasn/41132-3501",
            "method": "median",
            "location": "geoasn/41132-3501",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1178689
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-f1684fca56b1462023d84846",
      "entity_type": "asn",
      "entity_key": "AS41132",
      "geography": "SA",
      "started_at": "2026-09-20T08:25:00.000Z",
      "last_observed_at": "2026-09-20T08:25:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.895308524166799
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS41132"
      ],
      "affected_services": [],
      "affected_regions": [
        "SA"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-10-01T10:22:05.449Z",
      "updated_at": "2026-10-03T23:50:35.816Z",
      "evidence": [
        {
          "event_id": "ise-f1684fca56b1462023d84846",
          "stix_object_id": "incident--1662b30a-7335-54d5-8a69-fa28d839cc14",
          "platform": "ioda",
          "observed_at": "2026-09-20T08:25:00.000Z",
          "name": "sol-as -- Saudi Arabia",
          "value": "geoasn/41132-sa",
          "content_hash": "cc00ccdda6db56ae",
          "object_json": {
            "id": "incident--1662b30a-7335-54d5-8a69-fa28d839cc14",
            "name": "sol-as -- Saudi Arabia",
            "type": "incident",
            "score": 785792.6666666666,
            "title": "sol-as -- Saudi Arabia",
            "value": "geoasn/41132-sa",
            "method": "median",
            "location": "geoasn/41132-SA",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1178689
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-f3e299313fc0f960763b13ea",
      "entity_type": "asn",
      "entity_key": "AS41132",
      "geography": null,
      "started_at": "2026-09-20T08:25:00.000Z",
      "last_observed_at": "2026-09-20T08:25:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 30,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.895308524166799
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS41132"
      ],
      "affected_services": [],
      "affected_regions": [],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "ambiguous geography",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-10-01T10:22:05.437Z",
      "updated_at": "2026-10-03T23:50:35.825Z",
      "evidence": [
        {
          "event_id": "ise-f3e299313fc0f960763b13ea",
          "stix_object_id": "incident--7a2260ea-184d-5be7-9b66-8cf8acd87515",
          "platform": "ioda",
          "observed_at": "2026-09-20T08:25:00.000Z",
          "name": "AS41132 (sol-as)",
          "value": "asn/41132",
          "content_hash": "9f0fbba9e7683679",
          "object_json": {
            "id": "incident--7a2260ea-184d-5be7-9b66-8cf8acd87515",
            "name": "AS41132 (sol-as)",
            "type": "incident",
            "score": 785792.6666666666,
            "title": "AS41132 (sol-as)",
            "value": "asn/41132",
            "method": "median",
            "location": "asn/41132",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1178689
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-a20f5a04610cf369a3481c01",
      "entity_type": "country",
      "entity_key": "SA",
      "geography": "SA",
      "started_at": "2026-08-12T00:00:00.000Z",
      "last_observed_at": "2026-09-30T00:00:00.000Z",
      "status": "resolved",
      "classification": "APPLICATION_RESTRICTION",
      "trajectory": "RESOLVED",
      "stress_score": 24,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.44000000000000006,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 0.01
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.01
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 0.01
      },
      "affected_asns": [
        "AS8895"
      ],
      "affected_services": [
        "ChatGPT",
        "Claude",
        "Facebook",
        "Gemini",
        "Instagram",
        "ProtonVPN",
        "Signal",
        "Telegram",
        "TikTok",
        "WhatsApp",
        "X",
        "YouTube"
      ],
      "affected_regions": [
        "SA"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration"
      ],
      "observation_count": 4,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:23.066Z",
      "updated_at": "2026-10-03T23:50:22.711Z",
      "evidence": [
        {
          "event_id": "ise-a20f5a04610cf369a3481c01",
          "stix_object_id": "incident--063add14-fbaf-5029-97e9-07016a7c2b3c",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-12T00:00:00.000Z",
          "name": "Internet censorship detected in Saudi Arabia",
          "value": "sa-2026-0635",
          "content_hash": "de2546c8f26f5f95",
          "object_json": {
            "id": "incident--063add14-fbaf-5029-97e9-07016a7c2b3c",
            "name": "Internet censorship detected in Saudi Arabia",
            "type": "incident",
            "title": "Internet censorship detected in Saudi Arabia",
            "value": "sa-2026-0635",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-12T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 7/7 probes anomalous (100.0%) for bbc.com.",
            "anomaly_rate": 0.01,
            "country_code": "SA",
            "country_name": "Saudi Arabia",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-a20f5a04610cf369a3481c01",
          "stix_object_id": "incident--70d53fce-2f36-59d6-e790-2c82e70b67a1",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-23T00:00:00.000Z",
          "name": "Internet censorship detected in Saudi Arabia",
          "value": "sa-2026-0666",
          "content_hash": "6c7cdf164d83bb88",
          "object_json": {
            "id": "incident--70d53fce-2f36-59d6-e790-2c82e70b67a1",
            "name": "Internet censorship detected in Saudi Arabia",
            "type": "incident",
            "title": "Internet censorship detected in Saudi Arabia",
            "value": "sa-2026-0666",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-23T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 7/7 probes anomalous (100.0%) for bbc.com.",
            "anomaly_rate": 0.01,
            "country_code": "SA",
            "country_name": "Saudi Arabia",
            "spec_version": "2.1",
            "affected_asns": [
              "AS8895"
            ],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [
              "bbc.com",
              "chat.openai.com",
              "chatgpt.com",
              "claude.ai",
              "facebook.com",
              "gemini.google.com",
              "getlantern.org",
              "google.com",
              "huggingface.co",
              "instagram.com",
              "medium.com",
              "nytimes.com",
              "openai.com",
              "protonvpn.com",
              "psiphon.ca",
              "reddit.com",
              "signal.org",
              "substack.com",
              "telegram.org",
              "theguardian.com",
              "tiktok.com",
              "tumblr.com",
              "twitter.com",
              "whatsapp.com",
              "youtube.com"
            ],
            "affected_services": [
              "ChatGPT",
              "Claude",
              "Facebook",
              "Gemini",
              "Instagram",
              "ProtonVPN",
              "Signal",
              "Telegram",
              "TikTok",
              "WhatsApp",
              "X",
              "YouTube"
            ]
          }
        },
        {
          "event_id": "ise-a20f5a04610cf369a3481c01",
          "stix_object_id": "incident--67fcdfc1-aada-5830-272f-def88a90e9d8",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-27T00:00:00.000Z",
          "name": "Internet censorship detected in Saudi Arabia",
          "value": "sa-2026-0668",
          "content_hash": "10d22f4ef30d7c6b",
          "object_json": {
            "id": "incident--67fcdfc1-aada-5830-272f-def88a90e9d8",
            "name": "Internet censorship detected in Saudi Arabia",
            "type": "incident",
            "title": "Internet censorship detected in Saudi Arabia",
            "value": "sa-2026-0668",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-27T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 7/7 probes anomalous (100.0%) for bbc.com.",
            "anomaly_rate": 0.01,
            "country_code": "SA",
            "country_name": "Saudi Arabia",
            "spec_version": "2.1",
            "affected_asns": [
              "AS8895"
            ],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [
              "bbc.com",
              "chat.openai.com",
              "chatgpt.com",
              "claude.ai",
              "facebook.com",
              "gemini.google.com",
              "getlantern.org",
              "google.com",
              "huggingface.co",
              "instagram.com",
              "medium.com",
              "nytimes.com",
              "openai.com",
              "protonvpn.com",
              "psiphon.ca",
              "reddit.com",
              "signal.org",
              "substack.com",
              "telegram.org",
              "theguardian.com",
              "tiktok.com",
              "tumblr.com",
              "twitter.com",
              "whatsapp.com",
              "youtube.com"
            ],
            "affected_services": [
              "ChatGPT",
              "Claude",
              "Facebook",
              "Gemini",
              "Instagram",
              "ProtonVPN",
              "Signal",
              "Telegram",
              "TikTok",
              "WhatsApp",
              "X",
              "YouTube"
            ]
          }
        },
        {
          "event_id": "ise-a20f5a04610cf369a3481c01",
          "stix_object_id": "incident--444bfeb8-ecb3-5393-073a-bab2e070b99c",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-30T00:00:00.000Z",
          "name": "Internet censorship detected in Saudi Arabia",
          "value": "sa-2026-0670",
          "content_hash": "bc9a6c95633f10d7",
          "object_json": {
            "id": "incident--444bfeb8-ecb3-5393-073a-bab2e070b99c",
            "name": "Internet censorship detected in Saudi Arabia",
            "type": "incident",
            "title": "Internet censorship detected in Saudi Arabia",
            "value": "sa-2026-0670",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-30T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 7/7 probes anomalous (100.0%) for bbc.com.",
            "anomaly_rate": 0.01,
            "country_code": "SA",
            "country_name": "Saudi Arabia",
            "spec_version": "2.1",
            "affected_asns": [
              "AS8895"
            ],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [
              "bbc.com",
              "chat.openai.com",
              "chatgpt.com",
              "claude.ai",
              "facebook.com",
              "gemini.google.com",
              "getlantern.org",
              "google.com",
              "huggingface.co",
              "instagram.com",
              "medium.com",
              "nytimes.com",
              "openai.com",
              "protonvpn.com",
              "psiphon.ca",
              "reddit.com",
              "signal.org",
              "substack.com",
              "telegram.org",
              "theguardian.com",
              "tiktok.com",
              "tumblr.com",
              "twitter.com",
              "whatsapp.com",
              "youtube.com"
            ],
            "affected_services": [
              "ChatGPT",
              "Claude",
              "Facebook",
              "Gemini",
              "Instagram",
              "ProtonVPN",
              "Signal",
              "Telegram",
              "TikTok",
              "WhatsApp",
              "X",
              "YouTube"
            ]
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--3cf16648-f154-5bb4-1b35-cf3f5b10d032",
      "incident--1662b30a-7335-54d5-8a69-fa28d839cc14",
      "incident--7a2260ea-184d-5be7-9b66-8cf8acd87515",
      "incident--063add14-fbaf-5029-97e9-07016a7c2b3c",
      "incident--70d53fce-2f36-59d6-e790-2c82e70b67a1",
      "incident--67fcdfc1-aada-5830-272f-def88a90e9d8",
      "incident--444bfeb8-ecb3-5393-073a-bab2e070b99c"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}