OT/ICS Threat Intelligence API

{
  "name": "OT/ICS Threat Intelligence API",
  "description": "Hardware-aware threat intel for ICS/SCADA environments. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers: CVE triage, patch feasibility, internet-exposed device lookup, ICS threat actor profiles, sector threat mapping, IOC enrichment, live CISA advisory feed, asset risk verdict (escalate:true/false), active campaign tracker, sector change feed, ICS malware encyclopedia, complete sector threat brief with risk trend, ASN infrastructure profiling, compliance-gap mapping, deterministic threat scoring and remediation risk gating, AI/agentic copilot exposure, and composed synthesis (report, dossier, sitrep, article, LinkedIn, X). DeepSeek-enriched. No API keys \u2014 pure USDC micropayments on Base via x402.",
  "url": "https://ot-intel-api.onrender.com",
  "version": "1.0.0",
  "documentationUrl": "https://ot-intel-api.onrender.com/SKILL.md",
  "a2aEndpoint": "https://ot-intel-api.onrender.com/a2a",
  "mcpEndpoint": "https://ot-intel-api.onrender.com/mcp",
  "mcpServerCard": "https://ot-intel-api.onrender.com/mcp/server-card",
  "provider": {
    "organization": "OT Intel API",
    "url": "https://ot-intel-api.onrender.com"
  },
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "stateTransitionHistory": false
  },
  "payment": {
    "protocol": "x402",
    "network": "eip155:8453",
    "asset": "USDC",
    "facilitator": "CDP (Coinbase Developer Platform)"
  },
  "skills": [
    {
      "id": "ot-cve-triage",
      "name": "CVE Triage",
      "description": "OT-contextualised CVE triage with OT-adjusted severity, CISA KEV status, and cyber-physical impact assessment.",
      "tags": [
        "cve",
        "ics",
        "scada",
        "vulnerability",
        "security"
      ],
      "examples": [
        "Triage CVE-2023-38802 for ICS impact",
        "Is CVE-2021-34527 exploited in OT environments?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.02
    },
    {
      "id": "ot-patch-feasibility",
      "name": "Patch Feasibility",
      "description": "AI-powered patch feasibility assessment for OT/ICS environments with downtime estimation and deployment strategy.",
      "tags": [
        "patch",
        "ics",
        "scada",
        "vulnerability management"
      ],
      "examples": [
        "Can I patch CVE-2021-34527 without downtime?",
        "Patch strategy for Siemens S7-1200"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.05
    },
    {
      "id": "ot-device-exposure",
      "name": "Device Exposure Lookup",
      "description": "Internet-exposed OT device lookup by vendor/model with default credential risk and hardening recommendations.",
      "tags": [
        "device",
        "ics",
        "scada",
        "exposure",
        "shodan"
      ],
      "examples": [
        "Is Siemens S7-1200 exposed online?",
        "Default credentials for Unitronics Vision"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.05
    },
    {
      "id": "ot-threat-actor",
      "name": "ICS Threat Actor Profiles",
      "description": "ICS threat actor profiles with physical impact assessment, targeted sectors, and MITRE ATT&CK for ICS mapping.",
      "tags": [
        "threat actor",
        "apt",
        "ics",
        "scada",
        "mitre"
      ],
      "examples": [
        "Profile VOLTZITE threat actor",
        "SANDWORM MITRE techniques"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.03
    },
    {
      "id": "ot-actor-sector",
      "name": "Sector Threat Actor Mapping",
      "description": "All ICS threat actors targeting a specific industrial sector \u2014 energy, water, manufacturing, oil-and-gas, nuclear, chemical, transportation.",
      "tags": [
        "threat actor",
        "sector",
        "ics",
        "energy",
        "critical infrastructure"
      ],
      "examples": [
        "Which actors target energy sector?",
        "ICS groups targeting water utilities"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.03
    },
    {
      "id": "ot-ioc-enrichment",
      "name": "IOC Enrichment",
      "description": "IOC enrichment with ICS campaign context via AlienVault OTX \u2014 checks if indicator appears in OT-targeting threat feeds.",
      "tags": [
        "ioc",
        "threat intel",
        "ics",
        "scada",
        "otx"
      ],
      "examples": [
        "Is 185.220.101.45 associated with ICS attacks?",
        "Enrich domain evil.com for OT context"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.01
    },
    {
      "id": "ot-cisa-advisory",
      "name": "CISA ICS Advisory Feed",
      "description": "Live CISA ICS-CERT security advisories filtered by vendor or sector.",
      "tags": [
        "cisa",
        "advisory",
        "ics",
        "scada",
        "vulnerability"
      ],
      "examples": [
        "Latest CISA advisories for Siemens",
        "Recent ICS advisories for energy sector"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.02
    },
    {
      "id": "ot-exposure",
      "name": "Asset Risk Verdict",
      "description": "Asset-specific risk score and escalation verdict for OT/ICS devices. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Firmware-aware when firmware param provided.",
      "tags": [
        "risk-score",
        "ics",
        "scada",
        "triage",
        "escalation",
        "asset-risk"
      ],
      "examples": [
        "What is the risk of internet-facing Siemens S7-1500 in energy sector?",
        "Should I escalate this Schneider Modicon exposure?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.05
    },
    {
      "id": "ot-campaign",
      "name": "Active ICS Campaign Tracker",
      "description": "Active campaigns targeting a specific industrial sector right now. Returns campaign name, actor, start date, targeted geography, TTPs in use, and CVEs being exploited.",
      "tags": [
        "campaign",
        "ics",
        "scada",
        "active-threat",
        "sector-monitoring"
      ],
      "examples": [
        "What campaigns are active in the electric sector?",
        "Active ICS campaigns targeting water utilities"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.05
    },
    {
      "id": "ot-delta",
      "name": "Sector Change Feed",
      "description": "What is NEW for a sector in the last N days \u2014 new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes, not the full picture.",
      "tags": [
        "delta",
        "change-feed",
        "ics",
        "scada",
        "monitoring",
        "cron"
      ],
      "examples": [
        "What changed in water sector this week?",
        "New ICS CVEs in energy sector last 7 days"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.03
    },
    {
      "id": "ot-malware",
      "name": "ICS Malware Encyclopedia",
      "description": "Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted protocols, attributed actor, and MITRE ATT&CK for ICS techniques.",
      "tags": [
        "malware",
        "ics",
        "scada",
        "pipedream",
        "triton",
        "industroyer"
      ],
      "examples": [
        "Profile PIPEDREAM malware",
        "What protocols does TRITON target?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.02
    },
    {
      "id": "ot-brief",
      "name": "Sector Threat Brief",
      "description": "Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls.",
      "tags": [
        "brief",
        "threat-brief",
        "ics",
        "scada",
        "sector-report",
        "risk-trend",
        "compliance"
      ],
      "examples": [
        "Generate a 30-day threat brief for energy sector",
        "What is the risk trend for water utilities?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.1
    },
    {
      "id": "ot-asn-profiling",
      "name": "ICS Threat Actor ASN Infrastructure Profiling",
      "description": "Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE), phishing kit links, bulletproof hosting indicators, and OT-specific blocking recommendations. ASN analysis reveals infrastructure clustering that survives IP/domain rotation.",
      "tags": [
        "asn",
        "infrastructure",
        "ics",
        "threat-actor",
        "bulletproof-hosting",
        "c2",
        "blocking"
      ],
      "examples": [
        "Is AS215540 used by ICS threat actors?",
        "Profile ASN AS9009 for OT infrastructure links",
        "Should I block AS29802 at my OT firewall?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.03
    },
    {
      "id": "ot-detection-artifacts",
      "name": "ICS Detection Artifact Retrieval",
      "description": "Returns YARA/Sigma detection rules for ICS malware families (PIPEDREAM, INDUSTROYER2, TRITON) and threat actors. Public corpus rules marked validated:true are safe for staging deployment. Synthesised rules carry validated:false. For automated threat hunting pipelines.",
      "tags": [
        "detection",
        "yara",
        "sigma",
        "ics",
        "threat-hunting",
        "siem",
        "pipedream",
        "triton"
      ],
      "examples": [
        "Get YARA rules for PIPEDREAM",
        "Sigma rules for SANDWORM TTPs",
        "Detection artifacts for INDUSTROYER2"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.05
    },
    {
      "id": "ot-compliance-mapping",
      "name": "Multi-Framework Compliance Gap Mapping",
      "description": "Returns triggered controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic mapping shows which controls apply, compliance status, required action, and compensating controls. Optional framework= param filters to one standard. For automated compliance reporting agents.",
      "tags": [
        "compliance",
        "nerc-cip",
        "iec-62443",
        "nist-csf",
        "nca-otcc",
        "nesa-ia",
        "ics",
        "gap-analysis",
        "audit",
        "cve"
      ],
      "examples": [
        "What NERC CIP controls does CVE-2023-38802 trigger?",
        "IEC 62443 gaps for SANDWORM activity",
        "NCA OTCC posture for XENOTIME activity"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.04
    },
    {
      "id": "ot-compliance-batch",
      "name": "Aggregate Compliance Gap Assessment",
      "description": "Rolls up compliance-gap mapping across multiple CVEs/threat actors in one call \u2014 deduplicated triggered controls, one aggregate severity rating (HIGH/MEDIUM/LOW/CLEAN), and a remediation summary. Same 11-framework coverage as ot-compliance-mapping. For agents triaging a batch of new advisories at once instead of one call per finding.",
      "tags": [
        "compliance",
        "batch",
        "nerc-cip",
        "iec-62443",
        "nist-csf",
        "nca-otcc",
        "nesa-ia",
        "gap-analysis",
        "audit"
      ],
      "examples": [
        "Batch-assess NESA gaps for these 5 CVEs from this week's advisories",
        "Aggregate compliance severity for XENOTIME plus these 3 CVEs"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.2
    },
    {
      "id": "ot-threat-score",
      "name": "Actor-Target Threat Score",
      "description": "Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus live GDELT geopolitical tension and OFAC sanctions pressure signals. Not LLM-generated \u2014 the underlying score referenced by ot-risk-exposure and ot-action-conformance.",
      "tags": [
        "threat-score",
        "risk-scoring",
        "ics",
        "capability",
        "opportunity",
        "intent",
        "geopolitical",
        "sanctions"
      ],
      "examples": [
        "What's SANDWORM's threat score against energy targets in Europe?",
        "Score VOLTZITE's capability and intent against a Siemens/Schneider stack in GCC"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.04
    },
    {
      "id": "ot-precursor-ttp",
      "name": "Precursor / Dwell-Time TTP Breakdown",
      "description": "Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control \u2014 the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup \u2014 no LLM in the classification path.",
      "tags": [
        "ttp-analysis",
        "dwell-time",
        "early-warning",
        "mitre-attck",
        "ics",
        "reconnaissance"
      ],
      "examples": [
        "How much of SANDWORM's activity is pre-impact vs impact-stage?",
        "Does XENOTIME give an early-warning window before disruption?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.04
    },
    {
      "id": "ot-root-cause-localization",
      "name": "Statistical Anomaly Attribution",
      "description": "Ranks which sensors most likely drove a reported OT/ICS anomaly by statistical deviation (z-score) from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM. A statistical approximation of the attribution goal in Oswal et al. 2025 (kernel SHAP + temporal convolution autoencoder) \u2014 not a trained model, no SHAP values computed.",
      "tags": [
        "anomaly-detection",
        "root-cause",
        "ics",
        "scada",
        "statistical",
        "z-score"
      ],
      "examples": [
        "Which sensor caused this anomaly given these 5 tag histories?",
        "Rank these 8 SCADA tags by deviation from baseline around the 14:32 event"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.15
    },
    {
      "id": "ot-threat-hunt-control-loop",
      "name": "Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)",
      "description": "Flags control-loop reconnaissance patterns and living-off-the-land/RMM-tool abuse from caller-submitted process and command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134) for the threat model, Dragos's control-loop mapping concept for the recon indicators. ADVISORY ONLY \u2014 never executes containment or any network action.",
      "tags": [
        "threat-hunting",
        "advisory",
        "rmm-abuse",
        "living-off-the-land",
        "ics",
        "control-loop",
        "keyword-matching"
      ],
      "examples": [
        "Flag any concerning patterns in these observed processes on an OT asset",
        "Check this command history for living-off-the-land techniques"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.15
    },
    {
      "id": "ot-invariant-reachability",
      "name": "Physical Invariant Check",
      "description": "Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out over the same interval, via conservation of mass. Fully deterministic, no LLM. Loosely inspired by Barbhaya et al. 2025's physical-invariant residual check \u2014 not a reimplementation of their trained detection model. Flags inconsistency and direction; does not assert a specific cause.",
      "tags": [
        "physical-invariant",
        "mass-balance",
        "ics",
        "scada",
        "anomaly-detection",
        "deterministic"
      ],
      "examples": [
        "Is this tank's level change consistent with its metered flows?",
        "Check for a physical invariant violation on TANK_302 over the last minute"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.2
    },
    {
      "id": "ot-vendor-risk",
      "name": "OT/ICS Third-Party Vendor Risk",
      "description": "Supply-chain risk assessment for a specific OT/ICS vendor (e.g. Schneider Electric, Siemens, Rockwell Automation, ABB, Honeywell). Aggregates CVE, campaign, and threat actor mentions associated with the vendor and returns risk tier, confidence, and prescriptive supply-chain mitigation recommendations. Certain restricted-license third-party sources are excluded from analysis.",
      "tags": [
        "third-party-risk",
        "supply-chain",
        "ics",
        "vendor-risk",
        "vulnerability",
        "cve"
      ],
      "examples": [
        "Assess supply-chain risk for Schneider Electric Modicon",
        "What's the vendor risk for Siemens SIMATIC?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.15
    },
    {
      "id": "ot-mitigation-map",
      "name": "D3FEND-Mapped Mitigation Guidance",
      "description": "Maps MITRE ATT&CK for ICS techniques to MITRE D3FEND defensive countermeasures for a given threat actor, CVE, or technique ID. The technique-to-D3FEND mapping is always deterministic (local crosswalk); DeepSeek only selects the relevant technique when actor/CVE is given, and writes prescriptive architecture recommendations.",
      "tags": [
        "architecture",
        "d3fend",
        "mitre-attck",
        "ics",
        "mitigation",
        "defense-in-depth"
      ],
      "examples": [
        "What D3FEND controls mitigate SANDWORM's TTPs?",
        "Mitigation guidance for T0836",
        "Architecture recommendations for CVE-2024-XXXXX in a Schneider Modicon environment"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.2
    },
    {
      "id": "ot-risk-exposure",
      "name": "Board/GRC Portfolio Risk Aggregator",
      "description": "Aggregates deterministic threat-scores across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written board-level executive summary (BLUF, ICD-203 language). Optional compliance_framework param noted qualitatively in the narrative. For vCISO agents and GRC/board-reporting automation \u2014 portfolio-level companion to ot-threat-score.",
      "tags": [
        "grc",
        "board-report",
        "risk-exposure",
        "executive-summary",
        "ics",
        "portfolio-risk"
      ],
      "examples": [
        "What's our risk exposure in the GCC energy sector?",
        "Board summary of ICS threats to our water utility in KSA"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.4
    },
    {
      "id": "ot-action-conformance",
      "name": "Remediation Action Risk Gate",
      "description": "Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as ot-threat-score, with auditable rules layered on top \u2014 no LLM in the decision path. For agents that need a governance checkpoint before executing high-impact actions.",
      "tags": [
        "governance",
        "remediation",
        "risk-gate",
        "automation",
        "ics",
        "human-in-the-loop"
      ],
      "examples": [
        "Can I auto-block this IP linked to SANDWORM?",
        "Should quarantining this host be human-reviewed first?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.12
    },
    {
      "id": "ot-ai-exposure",
      "name": "AI/Agentic Copilot Attack Surface Lookup",
      "description": "Deterministic lookup of a vendor's publicly documented AI/agentic copilot in their OT/ICS product line, its autonomy level (advisory vs agentic \u2014 the primary risk differentiator), and the MITRE ATLAS techniques that apply given its access level. Hand-verified mapping, ATLAS IDs confirmed directly against the live matrix. No LLM in the lookup path.",
      "tags": [
        "ai-security",
        "agentic-ai",
        "mitre-atlas",
        "copilot",
        "ics",
        "supply-chain"
      ],
      "examples": [
        "Does Siemens have an AI copilot, and what's its attack surface?",
        "Is Honeywell's AI platform advisory or agentic?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.2
    },
    {
      "id": "ot-ai-uplift",
      "name": "Attacker AI-Uplift Exposure",
      "description": "Assesses how much a general-purpose AI agent (Claude, GPT) lowers the skill/time barrier for an attacker to find and reach a vendor's OT-adjacent footprint. Grounded in Dragos's May 2026 'AI in the Breach' precedent, not frontier-model governance thresholds. Distinct from ot-ai-exposure, which looks up a vendor's OWN embedded AI copilot. DeepSeek-synthesised over CTI corpus plus caller-declared deployment context.",
      "tags": [
        "ai-uplift",
        "ai-security",
        "reconnaissance",
        "ics",
        "supply-chain",
        "it-ot-boundary"
      ],
      "examples": [
        "How much does AI lower the attack barrier for Schneider Electric's Modicon line?",
        "Assess AI-uplift exposure for an internet-facing, single-factor-auth Siemens gateway"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.2
    },
    {
      "id": "ot-ai-attack-feasibility",
      "name": "LLM-Generated ICS Attack Feasibility",
      "description": "Deterministic lookup against one specific empirical study (Cook et al., ACM TOPS 2026) testing whether off-the-shelf LLMs (GPT-4o, Gemini, DeepSeek, Qwen, LLaMA \u2014 Claude excluded by the paper's own authors due to stronger safety guardrails) can generate working attack code against real PLCs. Narrow scope: only 3 vendors tested, only network/register-tags techniques ever succeeded, 1.08% overall success rate. Distinct from ot-ai-exposure (vendor's own AI copilot) and ot-ai-uplift (open-ended reconnaissance-uplift synthesis).",
      "tags": [
        "ai-security",
        "llm-attack-synthesis",
        "mitre-ics",
        "empirical-study",
        "ics",
        "plc"
      ],
      "examples": [
        "Can an off-the-shelf LLM generate a working attack for Brute Force I/O?",
        "Which techniques from the Triton campaign are LLM-achievable?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.2
    },
    {
      "id": "ot-claim-reliability",
      "name": "CTI Claim Reliability Scoring",
      "description": "Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes \u2014 spurious correlation, contradictory knowledge, constrained generalization \u2014 using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Flags constrained_generalization and caps confidence at low whenever no grounding text is found, rather than letting the model claim corroboration it doesn't have.",
      "tags": [
        "cti-reliability",
        "evidence-verification",
        "empirical-study",
        "ics",
        "confidence-scoring"
      ],
      "examples": [
        "How reliable is the claim that SANDWORM has pivoted to Gulf water utilities?",
        "Check this actor-attribution claim against intel.db before I act on it"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.2
    },
    {
      "id": "ot-stix-coverage",
      "name": "STIX Representability + Actionability Lookup",
      "description": "Deterministic lookup grounded in Hahn, Krief, Rebori-Carretero, Puzis, Elyashar & Urlaub, 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering \u2014 answering what STIX sharing alone can't tell you. No LLM in the lookup path.",
      "tags": [
        "stix",
        "threat-information-sharing",
        "empirical-study",
        "ics",
        "detection-engineering"
      ],
      "examples": [
        "If SANDWORM shares T0836 activity via STIX, can I actually build a detection from it?",
        "Does STIX have a way to represent Profibus command manipulation?"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.2
    },
    {
      "id": "ot-analyst-brief",
      "name": "Analyst Brief",
      "description": "BLUF-style decision-ready analyst brief with key judgments and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector.",
      "tags": [
        "bluf",
        "synthesis",
        "ics",
        "decision-support"
      ],
      "examples": [
        "Give me a decision-ready brief on SANDWORM for energy",
        "BLUF on VOLTZITE"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.12
    },
    {
      "id": "ot-vendor-risk-delta",
      "name": "Vendor-Swap Risk Comparison",
      "description": "Counterfactual comparison of two OT/ICS vendors' risk tiers, for pre-purchase or migration decisions.",
      "tags": [
        "vendor-risk",
        "counterfactual",
        "supply-chain",
        "procurement",
        "ics"
      ],
      "examples": [
        "Is switching from Siemens to Schneider Electric lower risk?",
        "Compare vendor risk: Rockwell vs Honeywell"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.2
    },
    {
      "id": "ot-sighting-submit",
      "name": "Submit OT Sighting",
      "description": "Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment, feeding the correlation corpus without storing an org identifier.",
      "tags": [
        "crowdsourced",
        "sighting",
        "ioc",
        "ttp",
        "ics"
      ],
      "examples": [
        "Report an IOC sighting in our energy-sector OT network",
        "Submit a TTP observation from KSA"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.05
    },
    {
      "id": "ot-gcc-bulletin",
      "name": "GCC OT Threat Sitrep (Public Bulletin)",
      "description": "Recurring public 'State of OT Threat Intel \u2014 GCC' sitrep, human-reviewed before publish.",
      "tags": [
        "sitrep",
        "gcc",
        "public-bulletin",
        "ics"
      ],
      "examples": [
        "Latest GCC OT threat bulletin",
        "GCC sitrep for July 2026"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.01
    },
    {
      "id": "ot-report",
      "name": "Threat Actor Report",
      "description": "Synthesised Markdown threat actor report for ICS/OT \u2014 executive summary, TTPs, campaigns, malware, and recommended actions. TLP: WHITE.",
      "tags": [
        "report",
        "synthesis",
        "ics",
        "actor"
      ],
      "examples": [
        "Full threat report on CHERNOVITE for energy sector",
        "Report on SANDWORM"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.25
    },
    {
      "id": "ot-dossier",
      "name": "Deep Actor Dossier",
      "description": "Deep actor intelligence dossier \u2014 full profile, infrastructure, IOC table, detection rules, and kill chain mapping. Most comprehensive single-call artifact available.",
      "tags": [
        "dossier",
        "synthesis",
        "ics",
        "actor"
      ],
      "examples": [
        "Deep dossier on SANDWORM",
        "Full IOC and infra profile for XENOTIME"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.35
    },
    {
      "id": "ot-sitrep",
      "name": "Sector Situation Report",
      "description": "30-day sector situation report \u2014 threat landscape, top actors, new advisories, what changed, compliance posture, and recommended priorities.",
      "tags": [
        "sitrep",
        "synthesis",
        "ics",
        "sector"
      ],
      "examples": [
        "30-day sitrep for energy sector",
        "Weekly briefing for water sector"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.35
    },
    {
      "id": "ot-article",
      "name": "CTI Article (Publication-Ready)",
      "description": "Publication-ready CTI article (~700 words), journalist-style with headline, lede, body, ATT&CK context, defanged IOCs, and TLP marking.",
      "tags": [
        "article",
        "content",
        "synthesis",
        "ics"
      ],
      "examples": [
        "Write a CTI article on CHERNOVITE",
        "Publication-ready piece on CVE-2024-12345"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.45
    },
    {
      "id": "ot-linkedin",
      "name": "LinkedIn Post",
      "description": "LinkedIn post for a CTI/ICS security audience \u2014 hook line, intelligence bullets, call to action, and hashtags. Ready to publish.",
      "tags": [
        "linkedin",
        "content",
        "synthesis",
        "ics"
      ],
      "examples": [
        "LinkedIn post about VOLTZITE",
        "Social post on CVE-2024-12345"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.15
    },
    {
      "id": "ot-xpost",
      "name": "X/Twitter Thread",
      "description": "X/Twitter thread (5-7 posts) for an ICS actor or CVE \u2014 hook, intel posts with ATT&CK IDs, mitigation post, and hashtag post.",
      "tags": [
        "twitter",
        "x",
        "content",
        "synthesis",
        "ics"
      ],
      "examples": [
        "X thread about XENOTIME",
        "Twitter thread on CVE-2024-12345"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "price_usd": 0.1
    }
  ],
  "responseSigning": {
    "address": "0x91eBb2c95e4C5A2728d4D8C1e4992E9C83eb8bF3",
    "scheme": "ot-intel-sig/1 (RFC8785-JCS + SHA-256 + EIP-191)",
    "keyInfo": "https://ot-intel-api.onrender.com/.well-known/ot-intel-signer.json"
  }
}