{
  "service": "h3xa",
  "kind": "executive-briefing",
  "generated_at": "2026-10-28T18:08:57.876Z",
  "model_version": "h3xa-iss-1.1",
  "situation": {
    "id": "sit-fec93ede4c5279a728a438e1",
    "scope_type": "country",
    "scope_key": "RO",
    "geography": "RO",
    "title": "Internet disruption in RO",
    "started_at": "2026-08-28T13:35:00.000Z",
    "last_observed_at": "2026-10-02T17:50:00.000Z",
    "status": "resolved",
    "classification": "UNKNOWN_DISRUPTION",
    "trajectory": "RESOLVED",
    "stress_score": 31,
    "confidence": 44,
    "event_count": 3,
    "affected_asns": [
      "AS49468"
    ],
    "affected_services": [],
    "affected_regions": [
      "RO",
      "3381"
    ],
    "source_count": 2,
    "record_origin": "unrecorded",
    "first_seen": "2026-08-29T22:33:35.373Z",
    "updated_at": "2026-10-03T23:39:47.034Z"
  },
  "events": [
    {
      "id": "ise-1cf4c7d4a7934ee35d6e0d24",
      "entity_type": "asn",
      "entity_key": "AS49468",
      "geography": "RO",
      "started_at": "2026-09-16T18:10:00.000Z",
      "last_observed_at": "2026-09-16T18:10:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.315619422922005
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS49468"
      ],
      "affected_services": [],
      "affected_regions": [
        "RO"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-30T03:05:25.318Z",
      "updated_at": "2026-10-03T23:50:34.651Z",
      "evidence": [
        {
          "event_id": "ise-1cf4c7d4a7934ee35d6e0d24",
          "stix_object_id": "incident--300cf938-d1ad-5ea2-b064-b4eb2e98c4ce",
          "platform": "ioda",
          "observed_at": "2026-09-16T18:10:00.000Z",
          "name": "MAGHOST_RO -- Romania",
          "value": "geoasn/49468-ro",
          "content_hash": "2a637bcb5d46ac1a",
          "object_json": {
            "id": "incident--300cf938-d1ad-5ea2-b064-b4eb2e98c4ce",
            "name": "MAGHOST_RO -- Romania",
            "type": "incident",
            "score": 206831.8055555555,
            "title": "MAGHOST_RO -- Romania",
            "value": "geoasn/49468-ro",
            "method": "median",
            "location": "geoasn/49468-RO",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1489189
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-4bc3597c0c705b95b9efb985",
      "entity_type": "asn",
      "entity_key": "AS49468",
      "geography": "3381",
      "started_at": "2026-09-16T18:10:00.000Z",
      "last_observed_at": "2026-09-16T18:10:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 31,
      "confidence": 0,
      "components": {
        "anomaly": 0,
        "breadth": 0.04000000000000001,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 1
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0
      },
      "baseline": {
        "signals": [
          "ioda.bgp.score"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "ioda.bgp.score": 5.373611107432495
      },
      "deviation": {
        "max_anomaly": 0,
        "max_deviation": 1
      },
      "affected_asns": [
        "AS49468"
      ],
      "affected_services": [],
      "affected_regions": [
        "3381"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration",
        "isolated observation"
      ],
      "observation_count": 1,
      "ingestion_method": null,
      "first_seen": "2026-09-30T03:05:25.311Z",
      "updated_at": "2026-10-03T23:50:34.660Z",
      "evidence": [
        {
          "event_id": "ise-4bc3597c0c705b95b9efb985",
          "stix_object_id": "incident--2f0491ed-cf62-5240-c899-5b346196af24",
          "platform": "ioda",
          "observed_at": "2026-09-16T18:10:00.000Z",
          "name": "MAGHOST_RO -- Timis",
          "value": "geoasn/49468-3381",
          "content_hash": "cca737be141d0738",
          "object_json": {
            "id": "incident--2f0491ed-cf62-5240-c899-5b346196af24",
            "name": "MAGHOST_RO -- Timis",
            "type": "incident",
            "score": 236379.20634920633,
            "title": "MAGHOST_RO -- Timis",
            "value": "geoasn/49468-3381",
            "method": "median",
            "location": "geoasn/49468-3381",
            "datasource": "bgp",
            "outage_type": "connectivity-drop",
            "spec_version": "2.1",
            "duration_seconds": 1489189
          }
        }
      ],
      "derivations": []
    },
    {
      "id": "ise-8fb47d10e3160e32f511772b",
      "entity_type": "country",
      "entity_key": "RO",
      "geography": "RO",
      "started_at": "2026-08-28T13:35:00.000Z",
      "last_observed_at": "2026-10-02T17:50:00.000Z",
      "status": "resolved",
      "classification": "UNKNOWN_DISRUPTION",
      "trajectory": "RESOLVED",
      "stress_score": 19,
      "confidence": 0,
      "components": {
        "anomaly": 0.08533063041447188,
        "breadth": 0.020000000000000004,
        "persistence": 1,
        "corroboration": 0,
        "baseline_deviation": 0.09316770186335403
      },
      "confidence_factors": {
        "method_diversity": 0.25,
        "source_agreement": 0,
        "timestamp_overlap": 0,
        "infrastructure_overlap": 0,
        "alternative_explanations": 0.6,
        "statistical_significance": 0.08533063041447188
      },
      "baseline": {
        "signals": [
          "voidly.anomaly_rate"
        ],
        "signal_count": 1
      },
      "current_measurement": {
        "voidly.anomaly_rate": 0.02127659574468085
      },
      "deviation": {
        "max_anomaly": 0.08533063041447188,
        "max_deviation": 0.09316770186335403
      },
      "affected_asns": [],
      "affected_services": [],
      "affected_regions": [
        "RO"
      ],
      "source_count": 1,
      "alternative_explanations": [
        "single-source signal",
        "low statistical significance",
        "insufficient corroboration"
      ],
      "observation_count": 6,
      "ingestion_method": null,
      "first_seen": "2026-08-29T22:33:27.356Z",
      "updated_at": "2026-10-03T23:50:27.826Z",
      "evidence": [
        {
          "event_id": "ise-8fb47d10e3160e32f511772b",
          "stix_object_id": "incident--1d704f68-88b3-5911-941a-d0434ff344d3",
          "platform": "voidly-atlas",
          "observed_at": "2026-08-28T13:35:00.000Z",
          "name": "Internet connectivity disruption in Romania",
          "value": "ro-2026-0051",
          "content_hash": "0f6bdbcdae56c108",
          "object_json": {
            "id": "incident--1d704f68-88b3-5911-941a-d0434ff344d3",
            "name": "Internet connectivity disruption in Romania",
            "type": "incident",
            "title": "Internet connectivity disruption in Romania",
            "value": "ro-2026-0051",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-08-28T13:35:00Z",
            "description": "IODA detected significant connectivity drop in Romania. 1 critical alerts recorded.",
            "anomaly_rate": 0.09316770186335403,
            "country_code": "RO",
            "country_name": "Romania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-8fb47d10e3160e32f511772b",
          "stix_object_id": "incident--acdbdd4f-e6b5-5dbe-0036-6927e06ff037",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-24T09:40:00.000Z",
          "name": "Internet connectivity disruption in Romania",
          "value": "ro-2026-0063",
          "content_hash": "88e6187f59eb1bf9",
          "object_json": {
            "id": "incident--acdbdd4f-e6b5-5dbe-0036-6927e06ff037",
            "name": "Internet connectivity disruption in Romania",
            "type": "incident",
            "title": "Internet connectivity disruption in Romania",
            "value": "ro-2026-0063",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-24T09:40:00Z",
            "description": "IODA detected significant connectivity drop in Romania. 1 critical alerts recorded.",
            "anomaly_rate": 0.012345679012345678,
            "country_code": "RO",
            "country_name": "Romania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": 0,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-8fb47d10e3160e32f511772b",
          "stix_object_id": "incident--1a1f7960-3ef3-5f50-0b20-7b67e2f25b03",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-27T08:15:00.000Z",
          "name": "Internet connectivity disruption in Romania",
          "value": "ro-2026-0064",
          "content_hash": "b346db161b1eea9c",
          "object_json": {
            "id": "incident--1a1f7960-3ef3-5f50-0b20-7b67e2f25b03",
            "name": "Internet connectivity disruption in Romania",
            "type": "incident",
            "title": "Internet connectivity disruption in Romania",
            "value": "ro-2026-0064",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-27T08:15:00Z",
            "description": "IODA detected significant connectivity drop in Romania. 1 critical alerts recorded.",
            "anomaly_rate": 0.022082018927444796,
            "country_code": "RO",
            "country_name": "Romania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-8fb47d10e3160e32f511772b",
          "stix_object_id": "incident--86549439-55ff-517e-55cd-a834e9a0a79f",
          "platform": "voidly-atlas",
          "observed_at": "2026-09-30T12:05:00.000Z",
          "name": "Internet connectivity disruption in Romania",
          "value": "ro-2026-0065",
          "content_hash": "8a1fd0ef87e60c6f",
          "object_json": {
            "id": "incident--86549439-55ff-517e-55cd-a834e9a0a79f",
            "name": "Internet connectivity disruption in Romania",
            "type": "incident",
            "title": "Internet connectivity disruption in Romania",
            "value": "ro-2026-0065",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-09-30T12:05:00Z",
            "description": "IODA detected significant connectivity drop in Romania. 1 critical alerts recorded.",
            "anomaly_rate": 0.024291497975708502,
            "country_code": "RO",
            "country_name": "Romania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-8fb47d10e3160e32f511772b",
          "stix_object_id": "incident--e97b9c4c-6f6b-539d-acd1-b0a8331b3961",
          "platform": "voidly-atlas",
          "observed_at": "2026-10-01T16:05:00.000Z",
          "name": "Internet connectivity disruption in Romania",
          "value": "ro-2026-0066",
          "content_hash": "8f068132067397bb",
          "object_json": {
            "id": "incident--e97b9c4c-6f6b-539d-acd1-b0a8331b3961",
            "name": "Internet connectivity disruption in Romania",
            "type": "incident",
            "title": "Internet connectivity disruption in Romania",
            "value": "ro-2026-0066",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-10-01T16:05:00Z",
            "description": "IODA detected significant connectivity drop in Romania. 1 critical alerts recorded.",
            "anomaly_rate": 0.02127659574468085,
            "country_code": "RO",
            "country_name": "Romania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        },
        {
          "event_id": "ise-8fb47d10e3160e32f511772b",
          "stix_object_id": "incident--0066b420-e42b-561f-ca11-7e9c669a4112",
          "platform": "voidly-atlas",
          "observed_at": "2026-10-02T17:50:00.000Z",
          "name": "Internet connectivity disruption in Romania",
          "value": "ro-2026-0067",
          "content_hash": "cd631c0bc16ea7e9",
          "object_json": {
            "id": "incident--0066b420-e42b-561f-ca11-7e9c669a4112",
            "name": "Internet connectivity disruption in Romania",
            "type": "incident",
            "title": "Internet connectivity disruption in Romania",
            "value": "ro-2026-0067",
            "status": "active",
            "sources": [
              "ioda"
            ],
            "end_time": null,
            "severity": "critical",
            "confidence": 65,
            "start_time": "2026-10-02T17:50:00Z",
            "description": "IODA detected significant connectivity drop in Romania. 1 critical alerts recorded.",
            "anomaly_rate": 0.02127659574468085,
            "country_code": "RO",
            "country_name": "Romania",
            "spec_version": "2.1",
            "affected_asns": [],
            "incident_type": "disruption",
            "duration_hours": null,
            "affected_domains": [],
            "affected_services": []
          }
        }
      ],
      "derivations": []
    }
  ],
  "context": [],
  "audit": {
    "principle": "Source observations stay attributed to their feed. Stress scores, classifications, and this pack are H3XA-derived and cite the inputs that produced them.",
    "weights": {
      "anomaly": 0.3,
      "breadth": 0.2,
      "persistence": 0.15,
      "corroboration": 0.2,
      "baseline_deviation": 0.15
    },
    "derivation_ids": [],
    "observation_ids": [
      "incident--300cf938-d1ad-5ea2-b064-b4eb2e98c4ce",
      "incident--2f0491ed-cf62-5240-c899-5b346196af24",
      "incident--1d704f68-88b3-5911-941a-d0434ff344d3",
      "incident--acdbdd4f-e6b5-5dbe-0036-6927e06ff037",
      "incident--1a1f7960-3ef3-5f50-0b20-7b67e2f25b03",
      "incident--86549439-55ff-517e-55cd-a834e9a0a79f",
      "incident--e97b9c4c-6f6b-539d-acd1-b0a8331b3961",
      "incident--0066b420-e42b-561f-ca11-7e9c669a4112"
    ],
    "cross_domain": "Attached air, maritime, reference-CTI, and proprietary nodes are co-occurrence notes. They are not inputs to the stress score."
  }
}