ot-intel-api.onrender.com x402 offerings

Deterministic lookup against Cook et al. (ACM TOPS 2026) testing whether off-the-shelf LLMs generate working ICS attack code. Pass technique (name/ID, e.g. 'Brute Force I/O' or T0806), vendor (Siemens, Schneider Electric, Rockwell Automation — only these tested), and/or campaign (Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, Triton). Only Network/Register-Tags techniques succeeded; 1.08% success rate; Claude excluded (stronger guardrails). No LLM in lookup path.

IOC enrichment with ICS campaign context. Pass ?value=1.2.3.4&type=ip or type=domain. Queries AlienVault OTX, AbuseIPDB, and DeepSeek CTI for OT campaign association. Returns verdict on whether the IOC is linked to ICS-targeting campaigns.

Recurring public "State of OT Threat Intel — GCC" sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Pass optional issue_date (YYYY-MM-DD) for a past edition; omit for the latest reviewed edition.

OT/ICS/SCADA threat intelligence for AI agents and industrial SOC automation. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers, covering CVE triage, internet-exposed device lookup, ICS threat actor profiles (SANDWORM, VOLTZITE, XENOTIME), IOC enrichment with OT campaign context, CISA ICS-CERT advisory feed, patch feasibility assessment, asset risk verdict (es...

OT/ICS/SCADA threat intelligence for AI agents and industrial SOC automation. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers, covering CVE triage, internet-exposed device lookup, ICS threat actor profiles (SANDWORM, VOLTZITE, XENOTIME), IOC enrichment with OT campaign context, CISA ICS-CERT advisory feed, patch feasibility assessment, asset risk verdict (es...

OT/ICS patch feasibility for a CVE. Pass ?id=CVE-XXXX-XXXX. Returns patch availability, OT-safe workarounds, patch complexity per ICS layer, estimated downtime, safe-to-patch-live flag, deployment strategy, and risk-vs-disruption score 1-10.

Capability x opportunity x intent threat score for an actor-target pairing. Pass actor, sector, region, vendor_stack. Deterministic scoring: actor/CVE/campaign data plus GDELT tension and OFAC sanctions pressure. Not LLM-generated.

Synthesised Markdown threat actor report for ICS/OT. Pass ?actor=CHERNOVITE&sector=energy. Fans out to actor, campaign, malware, advisory, detection primitives internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, TTPs, campaigns, malware, recommended actions. TLP: WHITE.

OT/ICS/SCADA threat intelligence for AI agents and industrial SOC automation. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers, covering CVE triage, internet-exposed device lookup, ICS threat actor profiles (SANDWORM, VOLTZITE, XENOTIME), IOC enrichment with OT campaign context, CISA ICS-CERT advisory feed, patch feasibility assessment, asset risk verdict (es...