# TeleSint Artifact Export

> TeleSint Artifact Export is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Exports a structured artifact (Sigma rule, STIX 2.1 bundle, or analyst report) for a specific threat intelligence record by UUID

## Facts

- Endpoint: GET https://telesint-api.onrender.com/artifact
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/telesint-artifact-export-27e7bf75
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zHfDYFKWpe87E7Fwor7TB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability telesint-artifact-export-27e7bf75
```

Example prompt: I just got a TeleSint record ID 'f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d' from a C2 lookup — can you export it as a STIX 2.1 bundle so I can feed it into my threat intel platform?

## When to prefer this

Use this endpoint when you already have a TeleSint record UUID (from any other TeleSint endpoint) and need to export it in a specific structured format — Sigma for SIEM ingestion, STIX 2.1 for threat intel platforms (e.g. OpenCTI, MISP), or analyst report for human review. Prefer this over re-querying the source endpoint when you need a different output representation of an already-retrieved record.

## Known failure modes

- Missing or invalid UUID returns a 400 or 404 error
- Invalid format enum value returns a validation error
- Payment not completed via USDC on Base mainnet returns a 402 Payment Required
- Record UUID not found in TeleSint database returns empty or error response
- Render cold-start latency may cause initial timeout on first request

## How this service works

CTI artifact export from a TeleSint record. Required: id (record UUID), format (sigma|stix|report). Returns Sigma rule, STIX 2.1 bundle, or structured analyst report built from real enriched intel.

## Output

A structured artifact keyed to the requested format: a STIX 2.1 bundle (with indicator, attack-pattern, and report objects tagged with MITRE ATT&CK techniques and confidence scores), a Sigma detection rule, or a prose analyst report — all derived from the original TeleSint intelligence record and enriched by DeepSeek AI with TLP classification.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "id",
      "format"
     ],
     "properties": {
      "id": {
       "type": "string",
       "description": "Intel record UUID from any TeleSint endpoint response (items[].id)"
      },
      "format": {
       "type": "string",
       "description": "Artifact format: sigma (detection rule) | stix (STIX 2.1 bundle) | report (analyst report)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "format": "stix",
  "source": "TeleSint",
  "artifact": {
   "id": "bundle--f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
   "type": "bundle",
   "objects": [
    {
     "id": "indicator--f8a3c1d2-ip-0",
     "name": "IP: 91.92.109.83",
     "type": "indicator",
     "labels": [
      "malicious-activity"
     ],
     "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.92.109.83']",
     "confidence": 90,
     "valid_from": "2026-05-27T09:15:00Z",
     "pattern_type": "stix",
     "spec_version": "2.1"
    },
    {
     "id": "attack-pattern--f8a3c1d2-T1071-001",
     "name": "Application Layer Protocol: Web Protocols",
     "type": "attack-pattern",
     "spec_version": "2.1",
     "external_references": [
      {
       "external_id": "T1071.001",
       "source_name": "mitre-attack"
      }
     ]
    },
    {
     "id": "report--f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
     "name": "Cobalt Strike beacon with malleable C2 profile mimicking Microsoft update traffic",
     "type": "report",
     "labels": [
      "c2",
      "cobalt-strike",
      "malleable-c2"
     ],
     "confidence": 90,
     "spec_version": "2.1"
    }
   ],
   "spec_version": "2.1"
  },
  "category": "c2",
  "endpoint": "artifact",
  "record_id": "f8a3c1d2-4b5e-4f6a-9c8d-1e2f3a4b5c6d",
  "generated_at": "2026-06-01T12:00:00Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-artifact-export-27e7bf75/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)