# CISA ICS Advisories Feed

> CISA ICS Advisories Feed is a paid API for AI agents from 2s.io, paid per call via x402, $0.012/call, status unknown (last checked 2026-09-15).

Fetches and optionally filters official CISA Industrial Control Systems (ICS) security advisories, normalized from the CISA advisory RSS feed, returned newest-first.

## Facts

- Endpoint: GET https://2s.io/api/security/ics-advisories
- Price: $0.012/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cisa-ics-advisories-feed-b046c272
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_CIjaiKgq8KHuSH4GPi-2C

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cisa-ics-advisories-feed-b046c272
```

Example prompt: Pull the 10 most recent CISA ICS advisories mentioning Siemens and give me a summary of each.

## When to prefer this

Use this endpoint when you need official, normalized CISA ICS advisory data for OT/SCADA/medical device vulnerabilities, especially when you want to filter by vendor or product name. Prefer this over generic CVE databases when the focus is specifically on industrial control systems and critical infrastructure advisories sourced directly from CISA.

## Known failure modes

- Invalid limit value (outside 1-100 range) returns an error
- No advisories match the keyword filter — returns empty list
- CISA RSS feed temporarily unavailable — upstream fetch failure
- Malformed query parameter types cause a 400-level error

## How this service works

CISA Industrial Control Systems (ICS) advisories — vulnerabilities in operational-technology gear (SCADA, PLCs, building automation, energy/manufacturing/transportation systems, and medical devices), from the official CISA advisory RSS feed. Each item is normalized to the canonical advisory id (ICSA-YY-DDD-NN, or ICSMA-YY-DDD-NN for medical), title, link to the full advisory, publication date (ISO), and a plain-text summary. Optionally filter by keyword (e.g. a vendor like "Siemens") and cap the count. Returned newest-first. Free, public-domain (CISA).

## Output

A list of normalized ICS advisories (up to the requested limit, default 25), each containing the canonical advisory ID (e.g. ICSA-24-123-01), title, link to the full CISA advisory page, ISO publication date, and a plain-text summary — sorted newest-first.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [],
     "properties": {
      "q": {
       "type": "string",
       "description": "Case-insensitive keyword filter on title + summary, e.g. \"Siemens\"."
      },
      "limit": {
       "type": "integer",
       "description": "Max advisories (1-100, default 25)."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-ics-advisories-feed-b046c272/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)