{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:28.606Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-e95455e69bbdc7d68b0ec048",
    "scope_type": "country",
    "scope_key": "BH",
    "geography": "BH",
    "title": "Internet disruption in BH",
    "started_at": "2026-08-12T00:00:00.000Z",
    "last_observed_at": "2026-09-30T00:00:00.000Z",
    "status": "resolved",
    "classification": "APPLICATION_RESTRICTION",
    "trajectory": "RESOLVED",
    "stress_score": 34,
    "confidence": 20,
    "event_count": 1,
    "affected_asns": [
      "AS51375"
    ],
    "affected_services": [
      "ProtonVPN",
      "X",
      "WhatsApp"
    ],
    "affected_regions": [
      "BH"
    ],
    "source_count": 1,
    "record_origin": "unrecorded",
    "first_seen": "2026-08-29T22:33:33.793Z",
    "updated_at": "2026-10-03T23:39:45.758Z"
  },
  "events": [
    {
      "id": "ise-9c68a8b006357fdf22f2c728",
      "entity_type": "country",
      "entity_key": "BH",
      "geography": "BH",
      "started_at": "2026-08-12T00:00:00.000Z",
      "last_observed_at": "2026-09-30T00:00:00.000Z",
      "status": "resolved",
      "classification": "APPLICATION_RESTRICTION",
      "trajectory": "RESOLVED",
      "stress_score": 34,
      "confidence": 0,
      "components": {
        "anomaly": 0.2780446846882655,
        "breadth": 0.24000000000000005,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 0.41773337641821057
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0.2780446846882655
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.01
      },
      "deviation": {
        "max_anomaly": 0.2780446846882655,
        "max_deviation": 0.41773337641821057
      },
      "affected_asns": [
        "AS51375"
      ],
      "affected_services": [
        "ProtonVPN",
        "X",
        "WhatsApp"
      ],
      "affected_regions": [
        "BH"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration"
      ],
      "observation_count": 6,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:23.126Z",
      "updated_at": "2026-10-03T23:50:22.624Z",
      "evidence": [
        {
          "event_id": "ise-9c68a8b006357fdf22f2c728",
          "stix_object_id": "incident--35143280-45a6-50b2-d8d7-4853169fda29",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-12T00:00:00.000Z",
          "name": "Internet censorship detected in Bahrain",
          "value": "bh-2026-0327",
          "content_hash": "5c8de65607285f97",
          "object_json": {
            "id": "incident--35143280-45a6-50b2-d8d7-4853169fda29",
            "name": "Internet censorship detected in Bahrain",
            "type": "incident",
            "title": "Internet censorship detected in Bahrain",
            "value": "bh-2026-0327",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-12T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 3/3 probes anomalous (100.0%) for getlantern.org.",
            "anomaly_rate": 0.01,
            "country_code": "BH",
            "country_name": "Bahrain",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-9c68a8b006357fdf22f2c728",
          "stix_object_id": "incident--58cb18cd-12dc-5bd3-1e05-2717444f2166",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-23T00:00:00.000Z",
          "name": "Internet censorship detected in Bahrain",
          "value": "bh-2026-0351",
          "content_hash": "caefed5628e706fd",
          "object_json": {
            "id": "incident--58cb18cd-12dc-5bd3-1e05-2717444f2166",
            "name": "Internet censorship detected in Bahrain",
            "type": "incident",
            "title": "Internet censorship detected in Bahrain",
            "value": "bh-2026-0351",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-23T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 3/3 probes anomalous (100.0%) for getlantern.org.",
            "anomaly_rate": 0.01,
            "country_code": "BH",
            "country_name": "Bahrain",
            "spec_version": "2.1",
            "affected_asns": [
              "AS51375"
            ],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [
              "getlantern.org",
              "protonvpn.com",
              "psiphon.ca"
            ],
            "affected_services": [
              "ProtonVPN"
            ]
          }
        },
        {
          "event_id": "ise-9c68a8b006357fdf22f2c728",
          "stix_object_id": "incident--c4e77a4e-f32a-5052-00fb-efc7837e2b0c",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-25T01:40:00.000Z",
          "name": "Internet connectivity disruption in Bahrain",
          "value": "bh-2026-0352",
          "content_hash": "48758e50115e78dd",
          "object_json": {
            "id": "incident--c4e77a4e-f32a-5052-00fb-efc7837e2b0c",
            "name": "Internet connectivity disruption in Bahrain",
            "type": "incident",
            "title": "Internet connectivity disruption in Bahrain",
            "value": "bh-2026-0352",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-25T02:30:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-25T01:40:00Z",
            "description": "IODA detected significant connectivity drop in Bahrain. 2 critical alerts recorded.",
            "anomaly_rate": 0.2990664943271578,
            "country_code": "BH",
            "country_name": "Bahrain",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0.8333,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-9c68a8b006357fdf22f2c728",
          "stix_object_id": "incident--557c510c-eb30-5183-0ec3-50bcf58265bc",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-27T00:00:00.000Z",
          "name": "Internet censorship detected in Bahrain",
          "value": "bh-2026-0354",
          "content_hash": "092236641b8ca959",
          "object_json": {
            "id": "incident--557c510c-eb30-5183-0ec3-50bcf58265bc",
            "name": "Internet censorship detected in Bahrain",
            "type": "incident",
            "title": "Internet censorship detected in Bahrain",
            "value": "bh-2026-0354",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-27T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 3/3 probes anomalous (100.0%) for getlantern.org.",
            "anomaly_rate": 0.01,
            "country_code": "BH",
            "country_name": "Bahrain",
            "spec_version": "2.1",
            "affected_asns": [
              "AS51375"
            ],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [
              "getlantern.org",
              "protonvpn.com",
              "psiphon.ca",
              "twitter.com"
            ],
            "affected_services": [
              "ProtonVPN",
              "X"
            ]
          }
        },
        {
          "event_id": "ise-9c68a8b006357fdf22f2c728",
          "stix_object_id": "incident--04c43ee9-24b5-5369-4a6f-62a04bf0e972",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-29T00:00:00.000Z",
          "name": "Censorship detected in BH",
          "value": "bh-2026-0355",
          "content_hash": "bde6ad7aa2c85c22",
          "object_json": {
            "id": "incident--04c43ee9-24b5-5369-4a6f-62a04bf0e972",
            "name": "Censorship detected in BH",
            "type": "incident",
            "title": "Censorship detected in BH",
            "value": "bh-2026-0355",
            "status": "suspected",
            "sources": [
              "ooni"
            ],
            "end_time": "2026-09-29T23:59:59Z",
            "severity": "critical",
            "confidence": 70,
            "start_time": "2026-09-29T00:00:00Z",
            "description": null,
            "anomaly_rate": 0.5,
            "country_code": "BH",
            "country_name": "Bahrain",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": [
              "WhatsApp"
            ]
          }
        },
        {
          "event_id": "ise-9c68a8b006357fdf22f2c728",
          "stix_object_id": "incident--d464dad4-1810-5967-c77d-09eccc02011d",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-30T00:00:00.000Z",
          "name": "Internet censorship detected in Bahrain",
          "value": "bh-2026-0357",
          "content_hash": "905453c54c8c2b0f",
          "object_json": {
            "id": "incident--d464dad4-1810-5967-c77d-09eccc02011d",
            "name": "Internet censorship detected in Bahrain",
            "type": "incident",
            "title": "Internet censorship detected in Bahrain",
            "value": "bh-2026-0357",
            "status": "suspected",
            "sources": [
              "censoredplanet"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-30T00:00:00Z",
            "description": "CenAlert detected interference. Impact: 1.0. Reported by: DNS blocking detected: 3/3 probes anomalous (100.0%) for getlantern.org.",
            "anomaly_rate": 0.01,
            "country_code": "BH",
            "country_name": "Bahrain",
            "spec_version": "2.1",
            "affected_asns": [
              "AS51375"
            ],
            "incident_type": "censorship",
            "duration_hours": null,
            "affected_domains": [
              "getlantern.org",
              "protonvpn.com",
              "psiphon.ca"
            ],
            "affected_services": [
              "ProtonVPN"
            ]
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--35143280-45a6-50b2-d8d7-4853169fda29",
      "incident--58cb18cd-12dc-5bd3-1e05-2717444f2166",
      "incident--c4e77a4e-f32a-5052-00fb-efc7837e2b0c",
      "incident--557c510c-eb30-5183-0ec3-50bcf58265bc",
      "incident--04c43ee9-24b5-5369-4a6f-62a04bf0e972",
      "incident--d464dad4-1810-5967-c77d-09eccc02011d"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}