{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:57.794Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-fbd2037593e7cb3d50977638",
    "scope_type": "country",
    "scope_key": "LT",
    "geography": "LT",
    "title": "Internet disruption in LT",
    "started_at": "2026-07-27T08:20:00.000Z",
    "last_observed_at": "2026-09-30T01:20:00.000Z",
    "status": "resolved",
    "classification": "ROUTING_DISRUPTION",
    "trajectory": "RESOLVED",
    "stress_score": 39,
    "confidence": 60,
    "event_count": 7,
    "affected_asns": [
      "AS43627",
      "AS41228"
    ],
    "affected_services": [],
    "affected_regions": [
      "LT",
      "2326",
      "2323"
    ],
    "source_count": 2,
    "record_origin": "unrecorded",
    "first_seen": "2026-08-29T22:33:29.290Z",
    "updated_at": "2026-10-03T23:39:42.838Z"
  },
  "events": [
    {
      "id": "ise-2e068d46127d70f485239ab2",
      "entity_type": "country",
      "entity_key": "LT",
      "geography": "LT",
      "started_at": "2026-08-11T15:15:00.000Z",
      "last_observed_at": "2026-09-30T01:20:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 39,
      "confidence": 9,
      "components": {
        "anomaly": 0.6971256043743268,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 0.18294427408416933
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.5,
        "statistical_significance": 0.6971256043743268
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.036231884057971016
      },
      "deviation": {
        "max_anomaly": 0.6971256043743268,
        "max_deviation": 0.18294427408416933
      },
      "affected_asns": [],
      "affected_services": [],
      "affected_regions": [
        "LT"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "insufficient corroboration"
      ],
      "observation_count": 5,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:22.445Z",
      "updated_at": "2026-10-03T23:50:22.020Z",
      "evidence": [
        {
          "event_id": "ise-2e068d46127d70f485239ab2",
          "stix_object_id": "incident--f5607263-db03-5200-7b6e-c0bb52c3488a",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-11T15:15:00.000Z",
          "name": "Internet connectivity disruption in Lithuania",
          "value": "lt-2026-0025",
          "content_hash": "a17c5e47d3e7c342",
          "object_json": {
            "id": "incident--f5607263-db03-5200-7b6e-c0bb52c3488a",
            "name": "Internet connectivity disruption in Lithuania",
            "type": "incident",
            "title": "Internet connectivity disruption in Lithuania",
            "value": "lt-2026-0025",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-11T15:15:00Z",
            "description": "IODA detected significant connectivity drop in Lithuania. 1 critical alerts recorded.",
            "anomaly_rate": 0.011764705882352941,
            "country_code": "LT",
            "country_name": "Lithuania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-2e068d46127d70f485239ab2",
          "stix_object_id": "incident--638dffeb-8a75-531e-7f89-5a4fe3ed5d5f",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-12T01:20:00.000Z",
          "name": "Internet connectivity disruption in Lithuania",
          "value": "lt-2026-0026",
          "content_hash": "e66a84802abcec43",
          "object_json": {
            "id": "incident--638dffeb-8a75-531e-7f89-5a4fe3ed5d5f",
            "name": "Internet connectivity disruption in Lithuania",
            "type": "incident",
            "title": "Internet connectivity disruption in Lithuania",
            "value": "lt-2026-0026",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-08-12T13:30:00Z",
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-08-12T01:20:00Z",
            "description": "IODA detected significant connectivity drop in Lithuania. 4 critical alerts recorded.",
            "anomaly_rate": 0.08436573742280264,
            "country_code": "LT",
            "country_name": "Lithuania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-2e068d46127d70f485239ab2",
          "stix_object_id": "incident--2ccb97f1-8380-5aa0-a7c9-30bfb2d3782f",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-27T03:05:00.000Z",
          "name": "Internet connectivity disruption in Lithuania",
          "value": "lt-2026-0029",
          "content_hash": "dbf5f1a91d765921",
          "object_json": {
            "id": "incident--2ccb97f1-8380-5aa0-a7c9-30bfb2d3782f",
            "name": "Internet connectivity disruption in Lithuania",
            "type": "incident",
            "title": "Internet connectivity disruption in Lithuania",
            "value": "lt-2026-0029",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-08-27T03:05:00Z",
            "description": "IODA detected significant connectivity drop in Lithuania. 2 critical alerts recorded.",
            "anomaly_rate": 0.04192546583850931,
            "country_code": "LT",
            "country_name": "Lithuania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-2e068d46127d70f485239ab2",
          "stix_object_id": "incident--f7ca2966-fe55-5ea1-0df8-6c485a96df77",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-29T23:00:00.000Z",
          "name": "Internet connectivity disruption in Lithuania",
          "value": "lt-2026-0035",
          "content_hash": "1dd9372c206e58e1",
          "object_json": {
            "id": "incident--f7ca2966-fe55-5ea1-0df8-6c485a96df77",
            "name": "Internet connectivity disruption in Lithuania",
            "type": "incident",
            "title": "Internet connectivity disruption in Lithuania",
            "value": "lt-2026-0035",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 67,
            "start_time": "2026-09-29T23:00:00Z",
            "description": "IODA detected significant connectivity drop in Lithuania. 3 critical alerts recorded.",
            "anomaly_rate": 0.22896291046539097,
            "country_code": "LT",
            "country_name": "Lithuania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-2e068d46127d70f485239ab2",
          "stix_object_id": "incident--c7a4a4dd-6291-52df-d0af-7fdd49ac9e25",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-30T01:20:00.000Z",
          "name": "Internet connectivity disruption in Lithuania",
          "value": "lt-2026-0036",
          "content_hash": "5ff718157b763b0d",
          "object_json": {
            "id": "incident--c7a4a4dd-6291-52df-d0af-7fdd49ac9e25",
            "name": "Internet connectivity disruption in Lithuania",
            "type": "incident",
            "title": "Internet connectivity disruption in Lithuania",
            "value": "lt-2026-0036",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": "2026-09-30T08:20:00Z",
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-30T01:20:00Z",
            "description": "IODA detected significant connectivity drop in Lithuania. 1 critical alerts recorded.",
            "anomaly_rate": 0.036231884057971016,
            "country_code": "LT",
            "country_name": "Lithuania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-e186bc702f5cb2580a37af99",
      "entity_type": "asn",
      "entity_key": "AS43627",
      "geography": "LT",
      "started_at": "2026-07-27T08:20:00.000Z",
      "last_observed_at": "2026-07-27T08:20:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.2874594288769705
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS43627"
      ],
      "affected_services": [],
      "affected_regions": [
        "LT"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:14.360Z",
      "updated_at": "2026-10-03T23:50:15.183Z",
      "evidence": [
        {
          "event_id": "ise-e186bc702f5cb2580a37af99",
          "stix_object_id": "incident--20839bfd-610c-562b-01a0-3c3ce0503ac0",
          "platform": "ioda",
          "observed_at": "2026-07-27T08:20:00.000Z",
          "name": "KLI-AS -- Lithuania",
          "value": "geoasn/43627-lt",
          "content_hash": "8f6c20e9e834b76b",
          "object_json": {
            "id": "incident--20839bfd-610c-562b-01a0-3c3ce0503ac0",
            "name": "KLI-AS -- Lithuania",
            "type": "incident",
            "score": 193846.15384615387,
            "title": "KLI-AS -- Lithuania",
            "value": "geoasn/43627-lt",
            "method": "median",
            "location": "geoasn/43627-LT",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1209600
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-f5c9d06a64a1cd706474d7ef",
      "entity_type": "asn",
      "entity_key": "AS41228",
      "geography": "2323",
      "started_at": "2026-09-14T06:50:00.000Z",
      "last_observed_at": "2026-09-14T06:50:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 6.453009738621804
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS41228"
      ],
      "affected_services": [],
      "affected_regions": [
        "2323"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-28T08:39:39.506Z",
      "updated_at": "2026-10-03T23:50:32.716Z",
      "evidence": [
        {
          "event_id": "ise-f5c9d06a64a1cd706474d7ef",
          "stix_object_id": "incident--bf0fe05c-0379-523e-dde9-27a2e09ec796",
          "platform": "ioda",
          "observed_at": "2026-09-14T06:50:00.000Z",
          "name": "NNT-AS41228 -- Utenos",
          "value": "geoasn/41228-2323",
          "content_hash": "821a6674d08261e2",
          "object_json": {
            "id": "incident--bf0fe05c-0379-523e-dde9-27a2e09ec796",
            "name": "NNT-AS41228 -- Utenos",
            "type": "incident",
            "score": 2837981.6666666665,
            "title": "NNT-AS41228 -- Utenos",
            "value": "geoasn/41228-2323",
            "method": "median",
            "location": "geoasn/41228-2323",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1702789
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-4680a09bee5fa29a22a7fb05",
      "entity_type": "asn",
      "entity_key": "AS43627",
      "geography": "2326",
      "started_at": "2026-07-27T08:20:00.000Z",
      "last_observed_at": "2026-07-27T08:20:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.423678572710871
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS43627"
      ],
      "affected_services": [],
      "affected_regions": [
        "2326"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:14.326Z",
      "updated_at": "2026-10-03T23:50:15.165Z",
      "evidence": [
        {
          "event_id": "ise-4680a09bee5fa29a22a7fb05",
          "stix_object_id": "incident--ab593d25-fe5d-5068-7ed1-f94f54ac8173",
          "platform": "ioda",
          "observed_at": "2026-07-27T08:20:00.000Z",
          "name": "KLI-AS -- Telšiai",
          "value": "geoasn/43627-2326",
          "content_hash": "6c9905a8b3a46c86",
          "object_json": {
            "id": "incident--ab593d25-fe5d-5068-7ed1-f94f54ac8173",
            "name": "KLI-AS -- Telšiai",
            "type": "incident",
            "score": 265263.1578947368,
            "title": "KLI-AS -- Telšiai",
            "value": "geoasn/43627-2326",
            "method": "median",
            "location": "geoasn/43627-2326",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1209600
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-debf809f05df00fd815a8db6",
      "entity_type": "asn",
      "entity_key": "AS41228",
      "geography": "LT",
      "started_at": "2026-09-14T06:50:00.000Z",
      "last_observed_at": "2026-09-14T06:50:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 6.453009738621804
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS41228"
      ],
      "affected_services": [],
      "affected_regions": [
        "LT"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-28T08:39:39.516Z",
      "updated_at": "2026-10-03T23:50:32.707Z",
      "evidence": [
        {
          "event_id": "ise-debf809f05df00fd815a8db6",
          "stix_object_id": "incident--86a73683-63d6-55d1-93d8-68f7acab038d",
          "platform": "ioda",
          "observed_at": "2026-09-14T06:50:00.000Z",
          "name": "NNT-AS41228 -- Lithuania",
          "value": "geoasn/41228-lt",
          "content_hash": "b488ea5f452ba19c",
          "object_json": {
            "id": "incident--86a73683-63d6-55d1-93d8-68f7acab038d",
            "name": "NNT-AS41228 -- Lithuania",
            "type": "incident",
            "score": 2837981.6666666665,
            "title": "NNT-AS41228 -- Lithuania",
            "value": "geoasn/41228-lt",
            "method": "median",
            "location": "geoasn/41228-LT",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1702789
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-7cb9109a3a0978a0785172a1",
      "entity_type": "asn",
      "entity_key": "AS41228",
      "geography": null,
      "started_at": "2026-09-14T06:50:00.000Z",
      "last_observed_at": "2026-09-14T06:50:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 30,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 6.453009738621804
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS41228"
      ],
      "affected_services": [],
      "affected_regions": [],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "ambiguous geography",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-28T08:39:39.493Z",
      "updated_at": "2026-10-03T23:50:32.725Z",
      "evidence": [
        {
          "event_id": "ise-7cb9109a3a0978a0785172a1",
          "stix_object_id": "incident--57a26a54-0a30-5e41-12a1-9c2da0ae5d3a",
          "platform": "ioda",
          "observed_at": "2026-09-14T06:50:00.000Z",
          "name": "AS41228 (NNT-AS41228)",
          "value": "asn/41228",
          "content_hash": "086b325e9033edc5",
          "object_json": {
            "id": "incident--57a26a54-0a30-5e41-12a1-9c2da0ae5d3a",
            "name": "AS41228 (NNT-AS41228)",
            "type": "incident",
            "score": 2837981.6666666665,
            "title": "AS41228 (NNT-AS41228)",
            "value": "asn/41228",
            "method": "median",
            "location": "asn/41228",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1702789
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-5501d442d2d847a9b8f7ef4d",
      "entity_type": "asn",
      "entity_key": "AS43627",
      "geography": null,
      "started_at": "2026-07-27T08:20:00.000Z",
      "last_observed_at": "2026-07-27T08:20:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 30,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.2874594288769705
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS43627"
      ],
      "affected_services": [],
      "affected_regions": [],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "ambiguous geography",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:14.369Z",
      "updated_at": "2026-10-03T23:50:15.175Z",
      "evidence": [
        {
          "event_id": "ise-5501d442d2d847a9b8f7ef4d",
          "stix_object_id": "incident--3d964fcb-33bf-5ad4-32fd-878afad09b9e",
          "platform": "ioda",
          "observed_at": "2026-07-27T08:20:00.000Z",
          "name": "AS43627 (KLI-AS)",
          "value": "asn/43627",
          "content_hash": "2e85dd1689e81ccf",
          "object_json": {
            "id": "incident--3d964fcb-33bf-5ad4-32fd-878afad09b9e",
            "name": "AS43627 (KLI-AS)",
            "type": "incident",
            "score": 193846.15384615387,
            "title": "AS43627 (KLI-AS)",
            "value": "asn/43627",
            "method": "median",
            "location": "asn/43627",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1209600
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--f5607263-db03-5200-7b6e-c0bb52c3488a",
      "incident--638dffeb-8a75-531e-7f89-5a4fe3ed5d5f",
      "incident--2ccb97f1-8380-5aa0-a7c9-30bfb2d3782f",
      "incident--f7ca2966-fe55-5ea1-0df8-6c485a96df77",
      "incident--c7a4a4dd-6291-52df-d0af-7fdd49ac9e25",
      "incident--20839bfd-610c-562b-01a0-3c3ce0503ac0",
      "incident--bf0fe05c-0379-523e-dde9-27a2e09ec796",
      "incident--ab593d25-fe5d-5068-7ed1-f94f54ac8173",
      "incident--86a73683-63d6-55d1-93d8-68f7acab038d",
      "incident--57a26a54-0a30-5e41-12a1-9c2da0ae5d3a",
      "incident--3d964fcb-33bf-5ad4-32fd-878afad09b9e"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}