# OT Intel API – STIX Coverage Lookup

> OT Intel API – STIX Coverage Lookup is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.2/call, status unknown (last checked 2026-09-14).

Returns STIX object coverage and actionability scoring for ICS/OT threat observables, mapped from academic research to ATT&CK-for-ICS techniques, CVEs, and ICS protocols.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/stix-coverage
- Price: $0.2/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-stix-coverage-lookup-50ff0c77
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_cguslum218ddINddm8g_l

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-stix-coverage-lookup-50ff0c77
```

Example prompt: Check the STIX coverage for ATT&CK ICS technique T0836 filtered to the Stuxnet campaign — I need to know which artifacts have full vs partial STIX support and whether parsers are available.

## When to prefer this

Use this endpoint when you need to assess whether a specific ICS/OT threat observable — identified by ATT&CK technique, CVE, or ICS protocol — has standardized STIX representation and automated detection feasibility, grounded in peer-reviewed academic research. Prefer this over generic CTI databases when the question is specifically about STIX schema coverage gaps for OT environments or when building detection engineering pipelines for industrial SOCs.

## Known failure modes

- Missing all required query params (technique_id, protocol, cve_id) returns 400 — at least one must be supplied
- Unknown technique ID or CVE not in the academic corpus returns empty matches array
- Invalid campaign filter value (not Triton/Stuxnet/Industroyer) may return no results
- Service hosted on Render free tier may cold-start with latency spike on first request
- Payment not processed (x402) blocks request before reaching the endpoint logic

## How this service works

Deterministic STIX representability + actionability lookup, grounded in Hahn/Krief et al. (arXiv:2512.18714v3, Jan 2026). Pass technique_id (MITRE ATT&CK ICS ID, optionally campaign=Triton|Stuxnet|Industroyer), protocol, or cve_id. Returns whether STIX 2.1 can represent the artifact (full/partial/none) and whether reporting gave enough detail to build a detection. Answers what STIX sharing alone can't tell you: is this actually actionable once shared. No LLM in the lookup path.

## Output

Returns a JSON object including the query echo, the academic source citation, corpus-level statistics (total observables scored, actionable count, STIX support breakdown), and per-technique or per-CVE/protocol artifact matches with fields for STIX object type, support level (full/partial/none), artifact detail quality, parser availability, and cross-campaign variance flag.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "cve_id": {
       "type": "string",
       "description": "CVE ID from the paper's 8-row CISA KEV table, e.g. CVE-2023-3595. At least one of technique_id, protocol, or cve_id is required."
      },
      "campaign": {
       "type": "string",
       "description": "Optional filter: Triton, Stuxnet, or Industroyer — narrows a technique_id lookup to one case study."
      },
      "protocol": {
       "type": "string",
       "description": "ICS protocol name, e.g. TriStation, S7Comm, IEC 61850 MMS, CIP. At least one of technique_id, protocol, or cve_id is required."
      },
      "technique_id": {
       "type": "string",
       "description": "MITRE ATT&CK ICS technique ID, e.g. T0836. At least one of technique_id, protocol, or cve_id is required."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "query": {
   "cve_id": null,
   "campaign": "Stuxnet",
   "protocol": null,
   "technique_id": "T0836"
  },
  "source": "Hahn, Krief, Rebori-Carretero, Puzis, Elyashar & Urlaub, arXiv:2512.18714v3 (Jan 2026)",
  "corpus_stats": {
   "actionable": 87,
   "not_actionable": 274,
   "no_stix_support": 69,
   "full_stix_support": 101,
   "partial_stix_support": 191,
   "total_observables_scored": 361
  },
  "technique_result": {
   "matches": [
    {
     "artifact": "Profibus messages to frequency-converter drives",
     "campaign": "Stuxnet",
     "proprietary": "open_standard",
     "stix_object": "NetworkTraffic:src/dst_payload_ref",
     "stix_support": "partial",
     "technique_id": "T0836",
     "artifact_detail": "described",
     "parser_available": "no"
    }
   ],
   "cross_campaign_variance": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-stix-coverage-lookup-50ff0c77/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)