{"domain":"ot-intel-api.onrender.com","count":8,"changes":[{"captured_at":"2026-10-21T06:38:12.864378","card_hash":"600dff1c1b494517b111bf5cd69d390de5d661bc674d9d483f605bd067a7b0d9","previous_card_hash":"4b768e18da0a8293e5edf9596ecf67fd781834a6aae9c2a5a5784a59abd5507f","diff":{"skills_added":[],"skills_removed":[],"skills_changed":[],"fields_changed":[],"other_changed":true,"is_empty":false,"human_summary":"internal fields changed"}},{"captured_at":"2026-10-19T22:00:31.632722","card_hash":"4b768e18da0a8293e5edf9596ecf67fd781834a6aae9c2a5a5784a59abd5507f","previous_card_hash":"ca29012497e10242212e7f27f153765da5680cb031c648b6ad84a123f9bc40f0","diff":{"skills_added":[],"skills_removed":[],"skills_changed":[],"fields_changed":[],"other_changed":true,"is_empty":false,"human_summary":"internal fields changed"}},{"captured_at":"2026-10-01T20:32:29","card_hash":"ca29012497e10242212e7f27f153765da5680cb031c648b6ad84a123f9bc40f0","previous_card_hash":"b8db401798f39cc635cb7a454e5831f01fb89a4b0e2301effea2f6d344a88a6c","diff":{"skills_added":[{"id":"ot-analyst-brief","name":"Analyst Brief","description":"BLUF-style decision-ready analyst brief with key judgments and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector.","tags":["bluf","synthesis","ics","decision-support"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-article","name":"CTI Article (Publication-Ready)","description":"Publication-ready CTI article (~700 words), journalist-style with headline, lede, body, ATT&CK context, defanged IOCs, and TLP marking.","tags":["article","content","synthesis","ics"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-dossier","name":"Deep Actor Dossier","description":"Deep actor intelligence dossier — full profile, infrastructure, IOC table, detection rules, and kill chain mapping. Most comprehensive single-call artifact available.","tags":["dossier","synthesis","ics","actor"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-gcc-bulletin","name":"GCC OT Threat Sitrep (Public Bulletin)","description":"Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish.","tags":["sitrep","gcc","public-bulletin","ics"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-linkedin","name":"LinkedIn Post","description":"LinkedIn post for a CTI/ICS security audience — hook line, intelligence bullets, call to action, and hashtags. Ready to publish.","tags":["linkedin","content","synthesis","ics"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-report","name":"Threat Actor Report","description":"Synthesised Markdown threat actor report for ICS/OT — executive summary, TTPs, campaigns, malware, and recommended actions. TLP: WHITE.","tags":["report","synthesis","ics","actor"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-sighting-submit","name":"Submit OT Sighting","description":"Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment, feeding the correlation corpus without storing an org identifier.","tags":["crowdsourced","sighting","ioc","ttp","ics"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-sitrep","name":"Sector Situation Report","description":"30-day sector situation report — threat landscape, top actors, new advisories, what changed, compliance posture, and recommended priorities.","tags":["sitrep","synthesis","ics","sector"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-vendor-risk-delta","name":"Vendor-Swap Risk Comparison","description":"Counterfactual comparison of two OT/ICS vendors' risk tiers, for pre-purchase or migration decisions.","tags":["vendor-risk","counterfactual","supply-chain","procurement","ics"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-xpost","name":"X/Twitter Thread","description":"X/Twitter thread (5-7 posts) for an ICS actor or CVE — hook, intel posts with ATT&CK IDs, mitigation post, and hashtag post.","tags":["twitter","x","content","synthesis","ics"],"inputModes":["application/json"],"outputModes":["application/json"]}],"skills_removed":[],"skills_changed":[],"fields_changed":[{"field":"description","before":"Hardware-aware threat intel for ICS/SCADA environments. Thirteen pay-per-call endpoints covering CVE triage, patch feasibility, internet-exposed device lookup, ICS threat actor profiles, sector threat mapping, IOC enrichment, live CISA advisory feed, asset risk verdict (escalate:true/false), active campaign tracker, sector change feed, ICS malware encyclopedia, complete sector threat brief with risk trend, and ASN infrastructure profiling for ICS threat actors. DeepSeek-enriched. No API keys — pure USDC micropayments on Base via x402.","after":"Hardware-aware threat intel for ICS/SCADA environments. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers: CVE triage, patch feasibility, internet-exposed device lookup, ICS threat actor profiles, sector threat mapping, IOC enrichment, live CISA advisory feed, asset risk verdict (escalate:true/false), active campaign tracker, sector change feed, ICS malware encyclopedia, complete sector threat brief with risk trend, ASN infrastructure profiling, compliance-gap mapping, deterministic threat scoring and remediation risk gating, AI/agentic copilot exposure, and composed synthesis (report, dossier, sitrep, article, LinkedIn, X). DeepSeek-enriched. No API keys — pure USDC micropayments on Base via x402."}],"other_changed":false,"is_empty":false,"human_summary":"added 10 skills · description Hardware-aware threat intel for ICS/SCAD → Hardware-aware threat intel for ICS/SCAD"}},{"captured_at":"2026-07-28T18:48:23","card_hash":"b8db401798f39cc635cb7a454e5831f01fb89a4b0e2301effea2f6d344a88a6c","previous_card_hash":"cdd8457b58c07681d4db133d7099e5e8bd65f4e93fff6ad45a91dd91c9c40ac2","diff":{"skills_added":[{"id":"ot-compliance-batch","name":"Aggregate Compliance Gap Assessment","description":"Rolls up compliance-gap mapping across multiple CVEs/threat actors in one call — deduplicated triggered controls, one aggregate severity rating (HIGH/MEDIUM/LOW/CLEAN), and a remediation summary. Same 11-framework coverage as ot-compliance-mapping. For agents triaging a batch of new advisories at once instead of one call per finding.","tags":["compliance","batch","nerc-cip","iec-62443","nist-csf","nca-otcc","nesa-ia","gap-analysis","audit"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-invariant-reachability","name":"Physical Invariant Check","description":"Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out over the same interval, via conservation of mass. Fully deterministic, no LLM. Loosely inspired by Barbhaya et al. 2025's physical-invariant residual check — not a reimplementation of their trained detection model. Flags inconsistency and direction; does not assert a specific cause.","tags":["physical-invariant","mass-balance","ics","scada","anomaly-detection","deterministic"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-precursor-ttp","name":"Precursor / Dwell-Time TTP Breakdown","description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup — no LLM in the classification path.","tags":["ttp-analysis","dwell-time","early-warning","mitre-attck","ics","reconnaissance"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-root-cause-localization","name":"Statistical Anomaly Attribution","description":"Ranks which sensors most likely drove a reported OT/ICS anomaly by statistical deviation (z-score) from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM. A statistical approximation of the attribution goal in Oswal et al. 2025 (kernel SHAP + temporal convolution autoencoder) — not a trained model, no SHAP values computed.","tags":["anomaly-detection","root-cause","ics","scada","statistical","z-score"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-threat-hunt-control-loop","name":"Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)","description":"Flags control-loop reconnaissance patterns and living-off-the-land/RMM-tool abuse from caller-submitted process and command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134) for the threat model, Dragos's control-loop mapping concept for the recon indicators. ADVISORY ONLY — never executes containment or any network action.","tags":["threat-hunting","advisory","rmm-abuse","living-off-the-land","ics","control-loop","keyword-matching"],"inputModes":["application/json"],"outputModes":["application/json"]}],"skills_removed":[],"skills_changed":[],"fields_changed":[],"other_changed":false,"is_empty":false,"human_summary":"added 5 skills"}},{"captured_at":"2026-07-23T04:37:46","card_hash":"cdd8457b58c07681d4db133d7099e5e8bd65f4e93fff6ad45a91dd91c9c40ac2","previous_card_hash":"6e81c4388c0f867af51ebcc9fce80dcfbeede02fe398727ac6aa8075ee0356f6","diff":{"skills_added":[{"id":"ot-ai-attack-feasibility","name":"LLM-Generated ICS Attack Feasibility","description":"Deterministic lookup against one specific empirical study (Cook et al., ACM TOPS 2026) testing whether off-the-shelf LLMs (GPT-4o, Gemini, DeepSeek, Qwen, LLaMA — Claude excluded by the paper's own authors due to stronger safety guardrails) can generate working attack code against real PLCs. Narrow scope: only 3 vendors tested, only network/register-tags techniques ever succeeded, 1.08% overall success rate. Distinct from ot-ai-exposure (vendor's own AI copilot) and ot-ai-uplift (open-ended reconnaissance-uplift synthesis).","tags":["ai-security","llm-attack-synthesis","mitre-ics","empirical-study","ics","plc"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-ai-exposure","name":"AI/Agentic Copilot Attack Surface Lookup","description":"Deterministic lookup of a vendor's publicly documented AI/agentic copilot in their OT/ICS product line, its autonomy level (advisory vs agentic — the primary risk differentiator), and the MITRE ATLAS techniques that apply given its access level. Hand-verified mapping, ATLAS IDs confirmed directly against the live matrix. No LLM in the lookup path.","tags":["ai-security","agentic-ai","mitre-atlas","copilot","ics","supply-chain"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-ai-uplift","name":"Attacker AI-Uplift Exposure","description":"Assesses how much a general-purpose AI agent (Claude, GPT) lowers the skill/time barrier for an attacker to find and reach a vendor's OT-adjacent footprint. Grounded in Dragos's May 2026 'AI in the Breach' precedent, not frontier-model governance thresholds. Distinct from ot-ai-exposure, which looks up a vendor's OWN embedded AI copilot. DeepSeek-synthesised over CTI corpus plus caller-declared deployment context.","tags":["ai-uplift","ai-security","reconnaissance","ics","supply-chain","it-ot-boundary"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-claim-reliability","name":"CTI Claim Reliability Scoring","description":"Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Flags constrained_generalization and caps confidence at low whenever no grounding text is found, rather than letting the model claim corroboration it doesn't have.","tags":["cti-reliability","evidence-verification","empirical-study","ics","confidence-scoring"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-stix-coverage","name":"STIX Representability + Actionability Lookup","description":"Deterministic lookup grounded in Hahn, Krief, Rebori-Carretero, Puzis, Elyashar & Urlaub, 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering — answering what STIX sharing alone can't tell you. No LLM in the lookup path.","tags":["stix","threat-information-sharing","empirical-study","ics","detection-engineering"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-threat-score","name":"Actor-Target Threat Score","description":"Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus live GDELT geopolitical tension and OFAC sanctions pressure signals. Not LLM-generated — the underlying score referenced by ot-risk-exposure and ot-action-conformance.","tags":["threat-score","risk-scoring","ics","capability","opportunity","intent","geopolitical","sanctions"],"inputModes":["application/json"],"outputModes":["application/json"]}],"skills_removed":[],"skills_changed":[],"fields_changed":[],"other_changed":false,"is_empty":false,"human_summary":"added 6 skills"}},{"captured_at":"2026-07-17T14:22:17","card_hash":"6e81c4388c0f867af51ebcc9fce80dcfbeede02fe398727ac6aa8075ee0356f6","previous_card_hash":"969480a091c5cb964e140f2a84a3cfe7d1259e0d495009276e7a96cd55be2f32","diff":{"skills_added":[{"id":"ot-action-conformance","name":"Remediation Action Risk Gate","description":"Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as ot-threat-score, with auditable rules layered on top — no LLM in the decision path. For agents that need a governance checkpoint before executing high-impact actions.","tags":["governance","remediation","risk-gate","automation","ics","human-in-the-loop"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-mitigation-map","name":"D3FEND-Mapped Mitigation Guidance","description":"Maps MITRE ATT&CK for ICS techniques to MITRE D3FEND defensive countermeasures for a given threat actor, CVE, or technique ID. The technique-to-D3FEND mapping is always deterministic (local crosswalk); DeepSeek only selects the relevant technique when actor/CVE is given, and writes prescriptive architecture recommendations.","tags":["architecture","d3fend","mitre-attck","ics","mitigation","defense-in-depth"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-risk-exposure","name":"Board/GRC Portfolio Risk Aggregator","description":"Aggregates deterministic threat-scores across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written board-level executive summary (BLUF, ICD-203 language). Optional compliance_framework param noted qualitatively in the narrative. For vCISO agents and GRC/board-reporting automation — portfolio-level companion to ot-threat-score.","tags":["grc","board-report","risk-exposure","executive-summary","ics","portfolio-risk"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-vendor-risk","name":"OT/ICS Third-Party Vendor Risk","description":"Supply-chain risk assessment for a specific OT/ICS vendor (e.g. Schneider Electric, Siemens, Rockwell Automation, ABB, Honeywell). Aggregates CVE, campaign, and threat actor mentions associated with the vendor and returns risk tier, confidence, and prescriptive supply-chain mitigation recommendations. Certain restricted-license third-party sources are excluded from analysis.","tags":["third-party-risk","supply-chain","ics","vendor-risk","vulnerability","cve"],"inputModes":["application/json"],"outputModes":["application/json"]}],"skills_removed":[],"skills_changed":[],"fields_changed":[],"other_changed":false,"is_empty":false,"human_summary":"added 4 skills"}},{"captured_at":"2026-07-10T00:16:24","card_hash":"969480a091c5cb964e140f2a84a3cfe7d1259e0d495009276e7a96cd55be2f32","previous_card_hash":"3bdb3444a3846b8a3a58e1944d4ac28edb0516ce87fd4679c1dcb44f8cb9dfef","diff":{"skills_added":[],"skills_removed":[],"skills_changed":[{"id":"ot-compliance-mapping","fields":["name","description","tags"]}],"fields_changed":[],"other_changed":false,"is_empty":false,"human_summary":"updated 1 skill"}},{"captured_at":"2026-07-06T18:07:49","card_hash":"3bdb3444a3846b8a3a58e1944d4ac28edb0516ce87fd4679c1dcb44f8cb9dfef","previous_card_hash":null,"diff":{"skills_added":[{"id":"ot-actor-sector","name":"Sector Threat Actor Mapping","description":"All ICS threat actors targeting a specific industrial sector — energy, water, manufacturing, oil-and-gas, nuclear, chemical, transportation.","tags":["threat actor","sector","ics","energy","critical infrastructure"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-asn-profiling","name":"ICS Threat Actor ASN Infrastructure Profiling","description":"Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE), phishing kit links, bulletproof hosting indicators, and OT-specific blocking recommendations. ASN analysis reveals infrastructure clustering that survives IP/domain rotation.","tags":["asn","infrastructure","ics","threat-actor","bulletproof-hosting","c2","blocking"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-brief","name":"Sector Threat Brief","description":"Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls.","tags":["brief","threat-brief","ics","scada","sector-report","risk-trend","compliance"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-campaign","name":"Active ICS Campaign Tracker","description":"Active campaigns targeting a specific industrial sector right now. Returns campaign name, actor, start date, targeted geography, TTPs in use, and CVEs being exploited.","tags":["campaign","ics","scada","active-threat","sector-monitoring"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-cisa-advisory","name":"CISA ICS Advisory Feed","description":"Live CISA ICS-CERT security advisories filtered by vendor or sector.","tags":["cisa","advisory","ics","scada","vulnerability"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-compliance-mapping","name":"NERC CIP + IEC 62443 Compliance Gap Mapping","description":"Returns triggered NERC CIP and IEC 62443 controls for a CVE or threat actor. Deterministic mapping shows which controls apply, compliance status, required action, and compensating controls. For automated compliance reporting agents.","tags":["compliance","nerc-cip","iec-62443","ics","gap-analysis","audit","cve"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-cve-triage","name":"CVE Triage","description":"OT-contextualised CVE triage with OT-adjusted severity, CISA KEV status, and cyber-physical impact assessment.","tags":["cve","ics","scada","vulnerability","security"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-delta","name":"Sector Change Feed","description":"What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes, not the full picture.","tags":["delta","change-feed","ics","scada","monitoring","cron"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-detection-artifacts","name":"ICS Detection Artifact Retrieval","description":"Returns YARA/Sigma detection rules for ICS malware families (PIPEDREAM, INDUSTROYER2, TRITON) and threat actors. Public corpus rules marked validated:true are safe for staging deployment. Synthesised rules carry validated:false. For automated threat hunting pipelines.","tags":["detection","yara","sigma","ics","threat-hunting","siem","pipedream","triton"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-device-exposure","name":"Device Exposure Lookup","description":"Internet-exposed OT device lookup by vendor/model with default credential risk and hardening recommendations.","tags":["device","ics","scada","exposure","shodan"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-exposure","name":"Asset Risk Verdict","description":"Asset-specific risk score and escalation verdict for OT/ICS devices. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Firmware-aware when firmware param provided.","tags":["risk-score","ics","scada","triage","escalation","asset-risk"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-ioc-enrichment","name":"IOC Enrichment","description":"IOC enrichment with ICS campaign context via AlienVault OTX — checks if indicator appears in OT-targeting threat feeds.","tags":["ioc","threat intel","ics","scada","otx"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-malware","name":"ICS Malware Encyclopedia","description":"Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted protocols, attributed actor, and MITRE ATT&CK for ICS techniques.","tags":["malware","ics","scada","pipedream","triton","industroyer"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-patch-feasibility","name":"Patch Feasibility","description":"AI-powered patch feasibility assessment for OT/ICS environments with downtime estimation and deployment strategy.","tags":["patch","ics","scada","vulnerability management"],"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ot-threat-actor","name":"ICS Threat Actor Profiles","description":"ICS threat actor profiles with physical impact assessment, targeted sectors, and MITRE ATT&CK for ICS mapping.","tags":["threat actor","apt","ics","scada","mitre"],"inputModes":["application/json"],"outputModes":["application/json"]}],"skills_removed":[],"skills_changed":[],"fields_changed":[{"field":"name","before":null,"after":"OT/ICS Threat Intelligence API"},{"field":"description","before":null,"after":"Hardware-aware threat intel for ICS/SCADA environments. Thirteen pay-per-call endpoints covering CVE triage, patch feasibility, internet-exposed device lookup, ICS threat actor profiles, sector threat mapping, IOC enrichment, live CISA advisory feed, asset risk verdict (escalate:true/false), active campaign tracker, sector change feed, ICS malware encyclopedia, complete sector threat brief with risk trend, and ASN infrastructure profiling for ICS threat actors. DeepSeek-enriched. No API keys — pure USDC micropayments on Base via x402."},{"field":"version","before":null,"after":"1.0.0"},{"field":"url","before":null,"after":"https://ot-intel-api.onrender.com"},{"field":"documentationUrl","before":null,"after":"https://ot-intel-api.onrender.com/SKILL.md"},{"field":"capabilities","before":null,"after":{"streaming":false,"pushNotifications":false,"stateTransitionHistory":false}},{"field":"provider","before":null,"after":{"organization":"OT Intel API","url":"https://ot-intel-api.onrender.com"}}],"other_changed":true,"is_empty":false,"human_summary":"added 15 skills · name ∅ → OT/ICS Threat Intelligence API · description ∅ → Hardware-aware threat intel for ICS/SCAD · version ∅ → 1.0.0 · url ∅ → https://ot-intel-api.onrender.com · documentationUrl ∅ → https://ot-intel-api.onrender.com/SKILL. · capabilities ∅ → none · provider ∅ → OT Intel API"}}]}