# OT/ICS IOC/TTP Sighting Submission

> OT/ICS IOC/TTP Sighting Submission is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-14).

Submits an anonymized IOC or TTP sighting observed in an OT/ICS environment to enrich a shared threat correlation corpus, without storing any organizational identifier.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/sighting/submit
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-ics-ioc-ttp-sighting-submission-c666ace4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fXwNo1cUnGvFPBb8cvBb3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-ics-ioc-ttp-sighting-submission-c666ace4
```

Example prompt: Can you submit an anonymous sighting to the OT threat corpus — we observed MITRE ATT&CK ICS technique T0814 in our energy sector facility in KSA, attributed to CHERNOVITE, at 2024-11-15T10:30:00Z?

## When to prefer this

Choose this endpoint when you want to anonymously contribute OT/ICS threat sightings to a shared correlation corpus without exposing your organization's identity. It is specifically designed for OT environments and accepts CVEs, MITRE ATT&CK for ICS technique IDs, and SHA256 hashes — making it preferable over generic threat intel submission APIs when your focus is industrial control system threats in specific sectors and regions.

## Known failure modes

- Missing required parameters (ioc_or_ttp_id, sector, or region) returns a 400 error
- Invalid IOC/TTP ID format (not a CVE, MITRE ATT&CK ICS technique, or SHA256) may be rejected or silently accepted with reduced correlation value
- Invalid ISO 8601 timestamp in observed_at returns a validation error
- Service unavailable on Render cold-start delays may cause timeout on first request
- Payment not processed (x402 protocol failure) results in 402 response and no sighting stored

## How this service works

Submit an anonymized IOC/TTP sighting observed in your own OT environment. Pass ioc_or_ttp_id, sector, region (actor_name, observed_at optional). Feeds the correlation corpus without storing an org identifier. Written to a separate sightings store, not intel.db.

## Output

A confirmation that the sighting has been written to the dedicated sightings store and will feed the OT threat correlation corpus. No organizational identifier is retained in the response or the stored record.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ioc_or_ttp_id",
      "sector",
      "region"
     ],
     "properties": {
      "region": {
       "type": "string",
       "description": "Region where this was observed e.g. KSA, UAE"
      },
      "sector": {
       "type": "string",
       "description": "Sector where this was observed e.g. energy, water"
      },
      "actor_name": {
       "type": "string",
       "description": "Optional actor name if the sighting is attributed"
      },
      "observed_at": {
       "type": "string",
       "description": "Optional ISO 8601 timestamp of observation"
      },
      "ioc_or_ttp_id": {
       "type": "string",
       "description": "CVE ID, MITRE ATT&CK-for-ICS technique ID, or sha256 hash"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-ics-ioc-ttp-sighting-submission-c666ace4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)