# OT Intel API – ICS Threat Actor Report

> OT Intel API – ICS Threat Actor Report is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.25/call, status unknown (last checked 2026-09-14).

Generates a comprehensive AI-enriched threat intelligence report for a named ICS/OT threat actor (e.g. CHERNOVITE, SANDWORM), covering campaigns, malware, advisories, and detection artifacts with MITRE ATT&CK ICS mapping

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/report
- Price: $0.25/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-ics-threat-actor-report-0af571ec
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_daR-p0IOYcmG1SVd3r9Yn

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-ics-threat-actor-report-0af571ec
```

Example prompt: Pull a full OT threat intelligence report on CHERNOVITE focused on the energy sector — I need their campaigns, malware, MITRE ATT&CK ICS techniques, and any CISA advisories.

## When to prefer this

Choose this endpoint when you need a consolidated, AI-enriched OT/ICS threat actor dossier in a single call rather than piecing together raw feeds. Ideal for industrial SOC automation, AI agent pipelines needing structured OT intelligence, or rapid threat briefing on named ICS actors like SANDWORM or CHERNOVITE. Best when you need cyber-physical impact context and MITRE ATT&CK ICS mapping that generic CTI APIs lack.

## Known failure modes

- Unknown or misspelled actor name returns empty or error response
- Missing required 'actor' query parameter causes 400 bad request
- Payment failure on Base mainnet (insufficient USDC) blocks access
- Render.com cold start may cause first-request latency spike
- Data freshness lag if upstream sources (CISA, NVD) are delayed
- Rate limiting or micropayment processing errors on x402 protocol

## How this service works

Synthesised Markdown threat actor report for ICS/OT. Pass ?actor=CHERNOVITE&sector=energy. Fans out to actor, campaign, malware, advisory, detection primitives internally (no extra charge) and synthesises via DeepSeek. Returns executive summary, TTPs, campaigns, malware, recommended actions. TLP: WHITE.

## Output

Returns a markdown-formatted threat report (~720 words) covering the requested ICS threat actor, including executive summary, campaign history, associated malware (e.g. PIPEDREAM, TRITON), CISA ICS-CERT advisories, MITRE ATT&CK for ICS technique mapping, IOC enrichment with OT campaign context, detection artifacts (YARA/Sigma), and TLP classification. Also includes metadata: generation timestamp, word count, and list of composed sub-reports.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "actor"
     ],
     "properties": {
      "actor": {
       "type": "string",
       "description": "ICS threat actor name e.g. CHERNOVITE, SANDWORM, VOLTZITE, XENOTIME"
      },
      "sector": {
       "type": "string",
       "description": "Optional sector focus e.g. energy, water, manufacturing"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tlp": "WHITE",
  "actor": "CHERNOVITE",
  "sector": "energy",
  "word_count": 720,
  "generated_at": "2026-06-21T10:00:00.000Z",
  "_composed_from": [
   "ot/actor",
   "ot/campaign",
   "ot/malware",
   "ot/advisory",
   "ot/detection"
  ],
  "report_markdown": "# Threat Report: CHERNOVITE\n## Executive Summary\nCHERNOVITE..."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-ics-threat-actor-report-0af571ec/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)