# CISA ICS-CERT Advisory Feed – Vendor/Sector Filter

> CISA ICS-CERT Advisory Feed – Vendor/Sector Filter is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Returns the latest CISA ICS-CERT security advisories filtered by vendor and/or industrial sector, including CVE lists, CVSS scores, and severity ratings.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/advisory
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-onrender-com-557e989a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ah1Gt0WPzGhQKUtcQmY5X

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-onrender-com-557e989a
```

Example prompt: Pull the latest CISA ICS-CERT advisories for Siemens in the energy sector — give me up to 15 results with their CVE IDs, CVSS scores, and severity.

## When to prefer this

Use this endpoint when you need live, up-to-date CISA ICS-CERT advisory data for a specific vendor (e.g. Siemens, Rockwell, Honeywell) or industrial sector (e.g. energy, water, manufacturing). Prefer it over static CVE databases when OT/ICS-specific advisories and CVSS context from CISA are required, especially for compliance or incident response triage in critical infrastructure environments.

## Known failure modes

- No matching advisories found for the given vendor/sector combination — returns empty result set
- CISA RSS feed temporarily unavailable — upstream fetch failure
- Invalid or unrecognized vendor/sector string — may return zero results without error
- Rate limiting or payment failure — 402 response if payment not included
- Render.com cold start latency on first request causing timeout

## How this service works

Live CISA ICS-CERT advisories filtered by vendor or sector. Pass ?vendor=siemens or ?sector=energy. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and sector tags. Up to 25 results.

## Output

Returns up to 25 (configurable via limit=) CISA ICS advisory records parsed from the live RSS feed, each containing advisory ID, title, CVE list, CVSS scores, severity level, and vendor match confirmation. Filtered by the specified vendor (e.g. siemens) and/or sector (e.g. energy).

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "limit": "10",
   "sector": "energy",
   "vendor": "siemens"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "limit": {
       "type": "string",
       "description": "Max advisories to return (default 10, max 25)"
      },
      "sector": {
       "type": "string",
       "description": "Sector e.g. energy, water, manufacturing, chemical, healthcare"
      },
      "vendor": {
       "type": "string",
       "description": "Vendor name e.g. siemens, schneider, rockwell, ge, honeywell"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "count": 2,
  "query": {
   "sector": null,
   "vendor": "siemens"
  },
  "freshness": "2025-05-22T10:00:00.000Z",
  "advisories": [
   {
    "id": "ICSA-25-014-09",
    "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-014-09",
    "cves": [
     "CVE-2024-23814"
    ],
    "title": "Siemens SIMATIC S7-1500 TM MFP",
    "cvss_max": 9.8,
    "ot_layer": "field_device",
    "severity": "critical",
    "published": "Tue, 14 Jan 2025 00:00:00 +0000",
    "ot_sectors": [
     "manufacturing",
     "energy"
    ],
    "ot_severity": "CRITICAL",
    "vendor_match": true
   }
  ],
  "data_sources": [
   "CISA-ICS-CERT"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-onrender-com-557e989a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)