# OT ATT&CK-for-ICS Precursor TTP Classifier

> OT ATT&CK-for-ICS Precursor TTP Classifier is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.04/call, status unknown (last checked 2026-09-14).

Classifies a named ICS/OT threat actor's known ATT&CK-for-ICS TTPs into pre-impact (recon through C2) vs impact-stage categories using deterministic tactic-taxonomy lookup.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/precursor-ttp
- Price: $0.04/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-att-ck-for-ics-precursor-ttp-classifier-accc571b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_j7rKxcsnks8ZM2-qvPrqk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-att-ck-for-ics-precursor-ttp-classifier-accc571b
```

Example prompt: Can you look up SANDWORM's ATT&CK-for-ICS TTPs and tell me which ones are pre-impact precursors versus impact-stage techniques — I want to know what early-warning signals to watch for before any physical disruption?

## When to prefer this

Choose this endpoint when you need a deterministic, non-hallucinated tactic-stage classification for a specific named ICS/OT threat actor and want to distinguish early-warning pre-impact TTPs from impact-stage techniques using the ATT&CK-for-ICS framework. Prefer this over general CTI feeds when the use case is specifically ICS/OT adversary tactic staging and you need SOC-ready, taxonomy-grounded output without LLM inference risk.

## Known failure modes

- Unknown or unrecognized actor name returns empty or 404 response
- Actor name typo or alternate naming convention causes no-match
- Actor has no recorded ATT&CK-for-ICS TTPs in the intel.db, returning empty buckets
- Service cold-start latency on Render.com free tier may cause initial timeout
- Missing required 'actor' query parameter returns 400 bad request

## How this service works

Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup against intel.db. Not LLM-generated.

## Output

A structured breakdown of the named actor's known ATT&CK-for-ICS TTPs bucketed into pre-impact tactics (reconnaissance through command-and-control — the early-warning window) and impact-stage tactics (inhibit-response-function, impair-process-control, impact), derived from a deterministic lookup against an intel database without LLM inference.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "actor"
     ],
     "properties": {
      "actor": {
       "type": "string",
       "description": "ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-att-ck-for-ics-precursor-ttp-classifier-accc571b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)