# OT Intel API — Active ICS Campaign Tracker

> OT Intel API — Active ICS Campaign Tracker is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-13).

Returns currently active (or all) threat campaigns targeting a specified industrial sector, with actor attribution, start dates, geographies, TTPs, and exploited CVEs.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/campaign
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-active-ics-campaign-tracker-af6242f1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1esf70GuqXVljnfFBjOQ3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-active-ics-campaign-tracker-af6242f1
```

Example prompt: What active threat campaigns are targeting the electric sector right now — I need actor attribution, the TTPs they're using, and any CVEs being exploited?

## When to prefer this

Use this endpoint when you need a live, structured view of active threat campaigns targeting a specific ICS/OT sector, including actor attribution, TTPs, and exploited CVEs. Prefer this over generic CTI feeds when the focus is specifically on operational technology or industrial control system environments. Choose this over the sector threat-actor listing endpoint when you need campaign-level granularity (start dates, geographies, CVEs in play) rather than just actor profiles.

## Known failure modes

- Missing required query parameters (sector or status) returns a 400 or error response
- Unknown or unsupported sector value may return empty results or an error
- Service may be unavailable or return 500 if the upstream data source is down
- Render cold-start latency may cause slow first response after inactivity
- No results returned if no campaigns match the requested sector/status combination

## How this service works

Active ICS campaign tracker. Pass ?sector=electric&status=active. Returns campaigns currently targeting a sector with actor attribution, start date, targeted geography, TTPs in use, and CVEs being exploited. No free equivalent for live campaign status.

## Output

A list of active (or all) threat campaigns targeting the requested industrial sector, each with: threat actor attribution, campaign start date, targeted geographic regions, TTPs in use (likely MITRE ATT&CK for ICS), and CVE identifiers being actively exploited in that campaign.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "sector": "energy",
   "status": "active"
  }
 },
 "output": {
  "type": "object"
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "sector"
     ],
     "properties": {
      "sector": {
       "type": "string",
       "description": "Industrial sector e.g. energy, water, electric, manufacturing, oil-and-gas, nuclear, chemical"
      },
      "status": {
       "type": "string",
       "description": "active (default) | all"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "sector": "electric",
  "status": "active",
  "campaigns": [
   {
    "name": "VOLTZITE Pre-Positioning Campaign",
    "actor": "VOLTZITE",
    "status": "active",
    "confidence": "high",
    "start_date": "2023-Q1",
    "ttps_in_use": [
     "T0859",
     "T0812",
     "T0885"
    ],
    "exploited_cves": [
     "CVE-2023-38380"
    ],
    "targeted_geography": [
     "United States",
     "Pacific Islands"
    ]
   }
  ],
  "freshness": "2026-06-13T10:00:00Z",
  "data_sources": [
   "MITRE-ATT&CK-ICS",
   "CISA-ICS-CERT",
   "OT-Intel-DB",
   "DeepSeek-CTI-Analysis"
  ],
  "campaign_count": 2
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-active-ics-campaign-tracker-af6242f1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)