# OT Intel API – ICS Threat Actor Dossier

> OT Intel API – ICS Threat Actor Dossier is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.35/call, status unknown (last checked 2026-09-14).

Returns a comprehensive AI-enriched intelligence dossier for a named ICS/OT threat actor (e.g. SANDWORM, XENOTIME, VOLTZITE), including campaigns, malware, IOCs, detection artifacts, and MITRE ATT&CK ICS mappings.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/dossier
- Price: $0.35/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-ics-threat-actor-dossier-11856add
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_PT3yU1-0j7a_xsSR1F_q8

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-ics-threat-actor-dossier-11856add
```

Example prompt: Pull me a full intelligence dossier on SANDWORM — I need their OT campaigns, associated malware like INDUSTROYER2, IOCs, MITRE ATT&CK ICS techniques, and any YARA or Sigma detection rules so our industrial SOC can start threat hunting.

## When to prefer this

Choose this endpoint when you need a comprehensive, pre-aggregated threat actor profile specifically for OT/ICS/SCADA environments, combining campaigns, malware, IOCs, detection artifacts, and compliance context in a single call. Prefer this over generic threat intel APIs when the focus is industrial control systems, critical infrastructure sectors, or cyber-physical impact assessment.

## Known failure modes

- Unknown or misspelled actor name returns empty or error response
- Actor not yet in knowledge base returns 404 or empty dossier
- Network timeout from Render.com cold start (free tier spin-up delay)
- USDC payment failure on Base mainnet blocks access
- Rate limiting or upstream data source unavailability causes partial dossier

## How this service works

Deep actor intelligence dossier. Pass ?actor=SANDWORM. Fans out to actor, campaign, malware, ioc, asn, detection primitives and synthesises via DeepSeek. Returns full profile, infrastructure, IOC table, detection rules, kill chain mapping. Most comprehensive single-call artifact available.

## Output

A structured JSON response containing a Markdown-formatted intelligence dossier (typically ~1100 words) for the requested ICS threat actor, with TLP classification, associated campaigns, malware encyclopedia entries, IOCs with OT campaign context, ASN infrastructure profiling, and YARA/Sigma detection artifacts — all AI-enriched with cyber-physical impact assessments and MITRE ATT&CK for ICS technique mappings.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "actor"
     ],
     "properties": {
      "actor": {
       "type": "string",
       "description": "ICS threat actor name e.g. SANDWORM, XENOTIME, VOLTZITE"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tlp": "WHITE",
  "actor": "SANDWORM",
  "word_count": 1100,
  "_composed_from": [
   "ot/actor",
   "ot/campaign",
   "ot/malware",
   "ot/ioc",
   "ot/asn",
   "ot/detection"
  ],
  "dossier_markdown": "# Intelligence Dossier: SANDWORM\n..."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-ics-threat-actor-dossier-11856add/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)