# OT-Intel ICS Sector Delta Feed

> OT-Intel ICS Sector Delta Feed is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-13).

Returns only new CVEs, CISA advisories, and threat actor activity for a given ICS/OT sector since the last N days — a change-only feed for efficient cron-based monitoring.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/delta
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-ics-sector-delta-feed-2c610eae
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_XLFO1KGlpNfNLV1aVxAzt

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-ics-sector-delta-feed-2c610eae
```

Example prompt: Check what's new in ICS threat intelligence for the water sector over the last 7 days — just give me the new CVEs, fresh CISA advisories, and any new threat actor activity, nothing I've already seen.

## When to prefer this

Choose this endpoint when you need to run recurring, scheduled monitoring of ICS/OT threat intelligence for a specific industrial sector without reprocessing previously seen data. Ideal for cron-based agents, alerting pipelines, or automated security workflows that need only what is genuinely new since the last poll. Prefer this over full-feed endpoints when efficiency and incremental updates matter.

## Known failure modes

- Missing required 'sector' or 'days' query parameters returns an error
- Invalid sector name (not in supported enum) returns no results or an error
- 'days' value exceeding 30 may be clamped or rejected
- Render.com cold-start latency may cause slow first response after idle period
- If upstream threat intel sources are unavailable, delta may be incomplete or stale

## How this service works

ICS sector change feed — only what is NEW in the last N days. Pass ?sector=water&days=7. Returns new CVEs, new CISA advisories, and new actor activity since the last call. Designed for cron-based monitoring agents. Eliminates redundant reprocessing.

## Output

A delta feed containing only items that are new within the specified lookback window: newly disclosed CVEs relevant to the sector, newly published CISA ICS-CERT advisories, and new threat actor activity targeting that industrial sector. Designed to avoid redundant reprocessing of previously seen data.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "days": "7",
   "sector": "water"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "sector"
     ],
     "properties": {
      "days": {
       "type": "string",
       "description": "Lookback window in days, default 7, max 30"
      },
      "sector": {
       "type": "string",
       "description": "Industrial sector e.g. energy, water, manufacturing, oil-and-gas, electric"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "since": "2026-06-06T00:00:00Z",
  "sector": "water",
  "new_cves": [
   {
    "id": "CVE-2026-1234",
    "cvss": 9.1,
    "ot_severity": "critical",
    "affected_vendors": [
     "Schneider Electric"
    ]
   }
  ],
  "freshness": "2026-06-13T10:00:00Z",
  "net_change": "1 new critical CVE, 1 new advisory",
  "data_sources": [
   "NVD",
   "CISA-ICS-CERT",
   "MITRE-ATT&CK-ICS"
  ],
  "new_advisories": [
   {
    "id": "ICSA-26-164-01",
    "title": "Schneider Electric Modicon",
    "cvss_max": 9.1
   }
  ],
  "new_actor_activity": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-ics-sector-delta-feed-2c610eae/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)