# OT/ICS D3FEND Mitigation Map

> OT/ICS D3FEND Mitigation Map is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-14).

Returns MITRE ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with prioritized prescriptive remediation guidance, given a threat actor, CVE, or technique ID.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/mitigation-map
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-ics-d3fend-mitigation-map-35ef2b92
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_IkAqzNtjvQgWy7X85mgRJ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-ics-d3fend-mitigation-map-35ef2b92
```

Example prompt: What D3FEND mitigations should we prioritize for SANDWORM tactics in our Schneider Modicon environment — give me the ATT&CK ICS techniques they use and prescriptive architecture recommendations.

## When to prefer this

Use this endpoint when you need prescriptive, D3FEND-framework-aligned defensive guidance specifically for OT/ICS environments, especially when starting from a known threat actor, CVE, or ATT&CK ICS technique ID. Prefer this over generic SIEM or IT security advice endpoints when the target environment includes industrial control systems, PLCs, SCADA, or similar OT infrastructure. Particularly valuable when vendor stack context (e.g. Schneider, Siemens) is known and can refine recommendations.

## Known failure modes

- No recognized threat actor, CVE, or technique ID provided — returns error requiring at least one of actor, cve_id, or technique_id
- Unknown or misspelled actor name not in knowledge base — may return empty or low-confidence results
- CVE not mapped to any ICS technique — returns limited or no D3FEND countermeasures
- Rate limiting or service unavailability from Render.com hosting — HTTP 429 or 503
- Payment not processed — HTTP 402 blocking access

## How this service works

Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of ?actor=<threat actor name>, ?cve_id=<CVE ID>, or ?technique_id=<MITRE ATT&CK ICS technique ID e.g. T0836>, optionally with &vendor_stack=<vendor/product context e.g. Schneider Modicon>. Returns matched ATT&CK ICS techniques mapped to D3FEND defensive countermeasures with priority and rationale, plus prescriptive architecture recommendations. DeepSeek-synthesised, ICD-203 estimative language.

## Output

A structured response containing matched ATT&CK ICS techniques relevant to the queried actor, CVE, or technique ID, each mapped to specific D3FEND defensive countermeasures with priority rankings and rationale, plus prescriptive OT/ICS architecture hardening recommendations. Language follows ICD-203 estimative standards (e.g. 'likely', 'almost certainly').

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "actor": {
       "type": "string",
       "description": "Threat actor name e.g. SANDWORM. At least one of actor, cve_id, or technique_id is required."
      },
      "cve_id": {
       "type": "string",
       "description": "CVE identifier. At least one of actor, cve_id, or technique_id is required."
      },
      "technique_id": {
       "type": "string",
       "description": "MITRE ATT&CK ICS technique ID e.g. T0836. At least one of actor, cve_id, or technique_id is required."
      },
      "vendor_stack": {
       "type": "string",
       "description": "Optional vendor/product context e.g. Schneider Modicon."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tlp": "TLP:CLEAR",
  "actor": "SANDWORM",
  "cve_id": null,
  "confidence": "moderate",
  "mitigations": [
   {
    "attack_technique_id": "T0836",
    "attack_technique_name": "Modify Parameter",
    "d3fend_countermeasures": [
     {
      "id": "D3-PSMD",
      "name": "Process Segment Monitoring / Deviation Detection",
      "priority": "high",
      "rationale": "Detects unauthorized setpoint changes."
     }
    ]
   }
  ],
  "vendor_stack": "Schneider Modicon",
  "architecture_recommendations": [
   "Deploy baseline deviation monitoring on Modicon controller parameter writes."
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-ics-d3fend-mitigation-map-35ef2b92/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)