# OT/ICS Sector Threat Brief

> OT/ICS Sector Threat Brief is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Returns a consolidated ICS/OT threat intelligence brief for a given industrial sector and lookback period, including active threat actors, new CVE counts, active campaigns, top advisories, and risk trend.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/brief
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-ics-sector-threat-brief-399f8b75
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_TcDDVhI-8bloq7dMtHly8

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-ics-sector-threat-brief-399f8b75
```

Example prompt: Give me a full ICS threat brief for the energy sector covering the last 30 days — I need active threat actors, new CVE counts, active campaigns, top advisories, and whether the overall risk is increasing, stable, or decreasing.

## When to prefer this

Use this endpoint when you need a single aggregated OT/ICS threat intelligence snapshot for a sector rather than making multiple separate calls for actors, CVEs, campaigns, and advisories. Ideal for weekly reporting, compliance dashboards, or executive summaries where breadth matters more than deep detail on a single indicator. Prefer this over the individual sibling endpoints when you want a consolidated risk_trend signal alongside all key threat dimensions in one response.

## Known failure modes

- Missing required 'sector' parameter returns 400 error
- Unrecognized sector value may return empty or error response
- Period value outside supported range may return 400 or default to 30 days
- Service unavailable on Render cold-start may cause timeout or 503
- Stale upstream threat intel feeds could produce outdated CVE counts or actor lists

## How this service works

Sector threat brief for ICS/OT. Pass ?sector=energy&period=30. Returns active actors, new CVE counts, active campaigns, top advisories, and risk_trend (increasing/stable/decreasing). One call replaces 5+ chained calls. Ideal for weekly reporting and compliance dashboards.

## Output

A consolidated threat intelligence brief containing: list of active threat actors targeting the specified sector, count of new CVEs disclosed in the period, list of active ICS campaigns, top CISA/ICS-CERT advisories, and a risk_trend indicator (increasing/stable/decreasing).

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "period": "30",
   "sector": "energy"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "sector"
     ],
     "properties": {
      "period": {
       "type": "string",
       "description": "Lookback window in days, default 30"
      },
      "sector": {
       "type": "string",
       "description": "Industrial sector e.g. energy, water, manufacturing, oil-and-gas, electric, nuclear"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "sector": "energy",
  "new_cves": 12,
  "freshness": "2026-06-13T10:00:00Z",
  "confidence": "high",
  "risk_trend": "increasing",
  "period_days": 30,
  "data_sources": [
   "NVD",
   "CISA-ICS-CERT",
   "MITRE-ATT&CK-ICS",
   "OT-Intel-DB",
   "DeepSeek-CTI-Analysis"
  ],
  "active_actors": [
   "VOLTZITE",
   "SANDWORM",
   "BENTONITE"
  ],
  "critical_cves": 3,
  "top_advisories": [
   {
    "id": "ICSA-26-150-01",
    "title": "Siemens SIMATIC S7-1500",
    "cvss_max": 9.8
   }
  ],
  "active_campaigns": 2,
  "recommended_actions": [
   "Patch CVE-2023-38380 on all internet-facing Siemens devices",
   "Monitor for LOTL techniques on OT-adjacent hosts",
   "Review remote access paths into the energy DMZ"
  ],
  "risk_trend_rationale": "VOLTZITE pre-positioning activity increased in Q2 2026 targeting US electric grid."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-ics-sector-threat-brief-399f8b75/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)