# OT Intel API – ICS Threat Actor Profile Lookup

> OT Intel API – ICS Threat Actor Profile Lookup is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Fetches a comprehensive ICS/OT threat actor profile by name, including MITRE ATT&CK for ICS technique mappings, known malware/tools, attribution, physical impact assessment, and recommended OT detections.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/actor
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-onrender-com-0cbb849d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_68LIomLDdxeOWN59QqMIg

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-onrender-com-0cbb849d
```

Example prompt: Pull the full ICS threat actor profile for SANDWORM — I want their MITRE ATT&CK for ICS technique mappings, known malware and tools, physical impact assessment, and recommended OT detections.

## When to prefer this

Use this endpoint when you need ICS/OT-specific threat intelligence for a named threat actor, especially when you need MITRE ATT&CK for ICS T-code mappings, OT-relevant malware associations, physical impact context, or CISA ICS advisory linkage. Prefer this over generic CTI APIs when the use case involves industrial control systems, SCADA, or critical infrastructure defense. Supports alias resolution, making it useful even when only common names or alternate designations are known.

## Known failure modes

- Unknown or misspelled actor name with no alias match — returns empty or error response
- MITRE ATT&CK or CISA upstream data unavailable — service may return partial results or timeout
- Actor exists in enterprise ATT&CK but not in ICS-specific context — limited results returned
- Render.com cold-start latency on first request after inactivity — slow response or timeout

## How this service works

ICS threat actor profile. Pass ?name=SANDWORM. Returns MITRE ATT&CK ICS techniques, known malware, attribution, physical impact, targeted sectors, and OT detection recommendations. Alias lookup supported: Volt Typhoon→VOLTZITE, APT44→SANDWORM. Covers all Dragos Activity Groups.

## Output

Returns a structured threat actor profile including: ICS-specific MITRE ATT&CK T-code technique mappings, known malware and tools used by the actor, related threat groups, recommended OT/ICS detection strategies, attribution details, physical impact assessment, and last known activity dates — sourced live from the MITRE ATT&CK for ICS STIX bundle and CISA ICS advisories, enriched by DeepSeek.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "name": "SANDWORM"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Actor name or alias e.g. VOLTZITE, SANDWORM, XENOTIME, Volt Typhoon, APT44"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "mitre_id": "G0034",
  "freshness": "2025-05-22T10:00:00.000Z",
  "attribution": "Russia — GRU Unit 74455",
  "data_sources": [
   "MITRE-ATT&CK-ICS",
   "Dragos-ICS-Threat-Intelligence"
  ],
  "canonical_name": "SANDWORM",
  "physical_impact": "CONFIRMED DESTRUCTIVE",
  "targeted_sectors": [
   "energy",
   "water",
   "government"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-onrender-com-0cbb849d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)