OT/ICS Threat Intelligence API

Hardware-aware threat intel for ICS/SCADA environments. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers: CVE triage, patch feasibility, internet-exposed device lookup, ICS threat actor profiles, sector threat mapping, IOC enrichment, live CISA advisory feed, asset risk verdict (escalate:true/false), active campaign tracker, sector change feed, ICS malware encyclopedia, complete sector threat brief with risk trend, ASN infrastructure profiling, compliance-gap mapping, deterministic threat scoring and remediation risk gating, AI/agentic copilot exposure, and composed synthesis (report, dossier, sitrep, article, LinkedIn, X). DeepSeek-enriched. No API keys — pure USDC micropayments on Base via x402.

Skills

• CVE Triage
  OT-contextualised CVE triage with OT-adjusted severity, CISA KEV status, and cyber-physical impact assessment.
  cveicsscadavulnerabilitysecurity
• Patch Feasibility
  AI-powered patch feasibility assessment for OT/ICS environments with downtime estimation and deployment strategy.
  patchicsscadavulnerability management
• Device Exposure Lookup
  Internet-exposed OT device lookup by vendor/model with default credential risk and hardening recommendations.
  deviceicsscadaexposureshodan
• ICS Threat Actor Profiles
  ICS threat actor profiles with physical impact assessment, targeted sectors, and MITRE ATT&CK for ICS mapping.
  threat actorapticsscadamitre
• Sector Threat Actor Mapping
  All ICS threat actors targeting a specific industrial sector — energy, water, manufacturing, oil-and-gas, nuclear, chemical, transportation.
  threat actorsectoricsenergycritical infrastructure
• IOC Enrichment
  IOC enrichment with ICS campaign context via AlienVault OTX — checks if indicator appears in OT-targeting threat feeds.
  iocthreat intelicsscadaotx
• CISA ICS Advisory Feed
  Live CISA ICS-CERT security advisories filtered by vendor or sector.
  cisaadvisoryicsscadavulnerability
• Asset Risk Verdict
  Asset-specific risk score and escalation verdict for OT/ICS devices. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Firmware-aware when firmware param provided.
  risk-scoreicsscadatriageescalationasset-risk
• Active ICS Campaign Tracker
  Active campaigns targeting a specific industrial sector right now. Returns campaign name, actor, start date, targeted geography, TTPs in use, and CVEs being exploited.
  campaignicsscadaactive-threatsector-monitoring
• Sector Change Feed
  What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes, not the full picture.
  deltachange-feedicsscadamonitoringcron
• ICS Malware Encyclopedia
  Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted protocols, attributed actor, and MITRE ATT&CK for ICS techniques.
  malwareicsscadapipedreamtritonindustroyer
• Sector Threat Brief
  Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls.
  briefthreat-brieficsscadasector-reportrisk-trendcompliance
• ICS Threat Actor ASN Infrastructure Profiling
  Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE), phishing kit links, bulletproof hosting indicators, and OT-specific blocking recommendations. ASN analysis reveals infrastructure clustering that survives IP/domain rotation.
  asninfrastructureicsthreat-actorbulletproof-hostingc2blocking
• ICS Detection Artifact Retrieval
  Returns YARA/Sigma detection rules for ICS malware families (PIPEDREAM, INDUSTROYER2, TRITON) and threat actors. Public corpus rules marked validated:true are safe for staging deployment. Synthesised rules carry validated:false. For automated threat hunting pipelines.
  detectionyarasigmaicsthreat-huntingsiempipedreamtriton
• Multi-Framework Compliance Gap Mapping
  Returns triggered controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic mapping shows which controls apply, compliance status, required action, and compensating controls. Optional framework= param filters to one standard. For automated compliance reporting agents.
  compliancenerc-cipiec-62443nist-csfnca-otccnesa-iaicsgap-analysisauditcve
• Aggregate Compliance Gap Assessment
  Rolls up compliance-gap mapping across multiple CVEs/threat actors in one call — deduplicated triggered controls, one aggregate severity rating (HIGH/MEDIUM/LOW/CLEAN), and a remediation summary. Same 11-framework coverage as ot-compliance-mapping. For agents triaging a batch of new advisories at once instead of one call per finding.
  compliancebatchnerc-cipiec-62443nist-csfnca-otccnesa-iagap-analysisaudit
• Actor-Target Threat Score
  Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus live GDELT geopolitical tension and OFAC sanctions pressure signals. Not LLM-generated — the underlying score referenced by ot-risk-exposure and ot-action-conformance.
  threat-scorerisk-scoringicscapabilityopportunityintentgeopoliticalsanctions
• Precursor / Dwell-Time TTP Breakdown
  Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup — no LLM in the classification path.
  ttp-analysisdwell-timeearly-warningmitre-attckicsreconnaissance
• Statistical Anomaly Attribution
  Ranks which sensors most likely drove a reported OT/ICS anomaly by statistical deviation (z-score) from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM. A statistical approximation of the attribution goal in Oswal et al. 2025 (kernel SHAP + temporal convolution autoencoder) — not a trained model, no SHAP values computed.
  anomaly-detectionroot-causeicsscadastatisticalz-score
• Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)
  Flags control-loop reconnaissance patterns and living-off-the-land/RMM-tool abuse from caller-submitted process and command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134) for the threat model, Dragos's control-loop mapping concept for the recon indicators. ADVISORY ONLY — never executes containment or any network action.
  threat-huntingadvisoryrmm-abuseliving-off-the-landicscontrol-loopkeyword-matching
• Physical Invariant Check
  Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out over the same interval, via conservation of mass. Fully deterministic, no LLM. Loosely inspired by Barbhaya et al. 2025's physical-invariant residual check — not a reimplementation of their trained detection model. Flags inconsistency and direction; does not assert a specific cause.
  physical-invariantmass-balanceicsscadaanomaly-detectiondeterministic
• OT/ICS Third-Party Vendor Risk
  Supply-chain risk assessment for a specific OT/ICS vendor (e.g. Schneider Electric, Siemens, Rockwell Automation, ABB, Honeywell). Aggregates CVE, campaign, and threat actor mentions associated with the vendor and returns risk tier, confidence, and prescriptive supply-chain mitigation recommendations. Certain restricted-license third-party sources are excluded from analysis.
  third-party-risksupply-chainicsvendor-riskvulnerabilitycve
• D3FEND-Mapped Mitigation Guidance
  Maps MITRE ATT&CK for ICS techniques to MITRE D3FEND defensive countermeasures for a given threat actor, CVE, or technique ID. The technique-to-D3FEND mapping is always deterministic (local crosswalk); DeepSeek only selects the relevant technique when actor/CVE is given, and writes prescriptive architecture recommendations.
  architectured3fendmitre-attckicsmitigationdefense-in-depth
• Board/GRC Portfolio Risk Aggregator
  Aggregates deterministic threat-scores across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written board-level executive summary (BLUF, ICD-203 language). Optional compliance_framework param noted qualitatively in the narrative. For vCISO agents and GRC/board-reporting automation — portfolio-level companion to ot-threat-score.
  grcboard-reportrisk-exposureexecutive-summaryicsportfolio-risk
• Remediation Action Risk Gate
  Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as ot-threat-score, with auditable rules layered on top — no LLM in the decision path. For agents that need a governance checkpoint before executing high-impact actions.
  governanceremediationrisk-gateautomationicshuman-in-the-loop
• AI/Agentic Copilot Attack Surface Lookup
  Deterministic lookup of a vendor's publicly documented AI/agentic copilot in their OT/ICS product line, its autonomy level (advisory vs agentic — the primary risk differentiator), and the MITRE ATLAS techniques that apply given its access level. Hand-verified mapping, ATLAS IDs confirmed directly against the live matrix. No LLM in the lookup path.
  ai-securityagentic-aimitre-atlascopiloticssupply-chain
• Attacker AI-Uplift Exposure
  Assesses how much a general-purpose AI agent (Claude, GPT) lowers the skill/time barrier for an attacker to find and reach a vendor's OT-adjacent footprint. Grounded in Dragos's May 2026 'AI in the Breach' precedent, not frontier-model governance thresholds. Distinct from ot-ai-exposure, which looks up a vendor's OWN embedded AI copilot. DeepSeek-synthesised over CTI corpus plus caller-declared deployment context.
  ai-upliftai-securityreconnaissanceicssupply-chainit-ot-boundary
• LLM-Generated ICS Attack Feasibility
  Deterministic lookup against one specific empirical study (Cook et al., ACM TOPS 2026) testing whether off-the-shelf LLMs (GPT-4o, Gemini, DeepSeek, Qwen, LLaMA — Claude excluded by the paper's own authors due to stronger safety guardrails) can generate working attack code against real PLCs. Narrow scope: only 3 vendors tested, only network/register-tags techniques ever succeeded, 1.08% overall success rate. Distinct from ot-ai-exposure (vendor's own AI copilot) and ot-ai-uplift (open-ended reconnaissance-uplift synthesis).
  ai-securityllm-attack-synthesismitre-icsempirical-studyicsplc
• CTI Claim Reliability Scoring
  Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Flags constrained_generalization and caps confidence at low whenever no grounding text is found, rather than letting the model claim corroboration it doesn't have.
  cti-reliabilityevidence-verificationempirical-studyicsconfidence-scoring
• STIX Representability + Actionability Lookup
  Deterministic lookup grounded in Hahn, Krief, Rebori-Carretero, Puzis, Elyashar & Urlaub, 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering — answering what STIX sharing alone can't tell you. No LLM in the lookup path.
  stixthreat-information-sharingempirical-studyicsdetection-engineering
• Analyst Brief
  BLUF-style decision-ready analyst brief with key judgments and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector.
  blufsynthesisicsdecision-support
• Vendor-Swap Risk Comparison
  Counterfactual comparison of two OT/ICS vendors' risk tiers, for pre-purchase or migration decisions.
  vendor-riskcounterfactualsupply-chainprocurementics
• Submit OT Sighting
  Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment, feeding the correlation corpus without storing an org identifier.
  crowdsourcedsightingiocttpics
• GCC OT Threat Sitrep (Public Bulletin)
  Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish.
  sitrepgccpublic-bulletinics
• Threat Actor Report
  Synthesised Markdown threat actor report for ICS/OT — executive summary, TTPs, campaigns, malware, and recommended actions. TLP: WHITE.
  reportsynthesisicsactor
• Deep Actor Dossier
  Deep actor intelligence dossier — full profile, infrastructure, IOC table, detection rules, and kill chain mapping. Most comprehensive single-call artifact available.
  dossiersynthesisicsactor
• Sector Situation Report
  30-day sector situation report — threat landscape, top actors, new advisories, what changed, compliance posture, and recommended priorities.
  sitrepsynthesisicssector
• CTI Article (Publication-Ready)
  Publication-ready CTI article (~700 words), journalist-style with headline, lede, body, ATT&CK context, defanged IOCs, and TLP marking.
  articlecontentsynthesisics
• LinkedIn Post
  LinkedIn post for a CTI/ICS security audience — hook line, intelligence bullets, call to action, and hashtags. Ready to publish.
  linkedincontentsynthesisics
• X/Twitter Thread
  X/Twitter thread (5-7 posts) for an ICS actor or CVE — hook, intel posts with ATT&CK IDs, mitigation post, and hashtag post.
  twitterxcontentsynthesisics

How to call

https://ot-intel-api.onrender.com

Listed in

Directories this entry was found in.