{"name":"OT/ICS Threat Intelligence API","description":"Hardware-aware threat intel for ICS/SCADA environments. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers: CVE triage, patch feasibility, internet-exposed device lookup, ICS threat actor profiles, sector threat mapping, IOC enrichment, live CISA advisory feed, asset risk verdict (escalate:true/false), active campaign tracker, sector change feed, ICS malware encyclopedia, complete sector threat brief with risk trend, ASN infrastructure profiling, compliance-gap mapping, deterministic threat scoring and remediation risk gating, AI/agentic copilot exposure, and composed synthesis (report, dossier, sitrep, article, LinkedIn, X). DeepSeek-enriched. No API keys — pure USDC micropayments on Base via x402.","url":"https://ot-intel.daligence.com","version":"1.0.0","documentationUrl":"https://ot-intel.daligence.com/SKILL.md","a2aEndpoint":"https://ot-intel.daligence.com/a2a","mcpEndpoint":"https://ot-intel.daligence.com/mcp","mcpServerCard":"https://ot-intel.daligence.com/mcp/server-card","provider":{"organization":"OT Intel API","url":"https://ot-intel.daligence.com"},"capabilities":{"streaming":false,"pushNotifications":false,"stateTransitionHistory":false},"payment":{"protocol":"x402","network":"eip155:8453","asset":"USDC","facilitator":"CDP (Coinbase Developer Platform)"},"skills":[{"id":"ot-cve-triage","name":"CVE Triage","description":"OT-contextualised CVE triage with OT-adjusted severity, CISA KEV status, and cyber-physical impact assessment.","tags":["cve","ics","scada","vulnerability","security"],"examples":["Triage CVE-2023-38802 for ICS impact","Is CVE-2021-34527 exploited in OT environments?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.02},{"id":"ot-patch-feasibility","name":"Patch Feasibility","description":"AI-powered patch feasibility assessment for OT/ICS environments with downtime estimation and deployment strategy.","tags":["patch","ics","scada","vulnerability management"],"examples":["Can I patch CVE-2021-34527 without downtime?","Patch strategy for Siemens S7-1200"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.05},{"id":"ot-device-exposure","name":"Device Security Profile","description":"OT device security profile by vendor/model: NVD CVEs, CISA ICS advisories, and a model-written hardening profile (default credential risk, OT protocols at risk). Not an internet exposure scan.","tags":["device","ics","scada","cve","hardening"],"examples":["What CVEs and CISA advisories affect the Siemens S7-1200?","Default credential risk for Unitronics Vision"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.05},{"id":"ot-threat-actor","name":"ICS Threat Actor Profiles","description":"ICS threat actor profiles with physical impact assessment, targeted sectors, and MITRE ATT&CK for ICS mapping.","tags":["threat actor","apt","ics","scada","mitre"],"examples":["Profile VOLTZITE threat actor","SANDWORM MITRE techniques"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.03},{"id":"ot-actor-sector","name":"Sector Threat Actor Mapping","description":"All ICS threat actors targeting a specific industrial sector — energy, water, manufacturing, oil-and-gas, nuclear, chemical, transportation.","tags":["threat actor","sector","ics","energy","critical infrastructure"],"examples":["Which actors target energy sector?","ICS groups targeting water utilities"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.03},{"id":"ot-ioc-enrichment","name":"IOC Enrichment","description":"IOC enrichment with ICS campaign context via AlienVault OTX — checks if indicator appears in OT-targeting threat feeds.","tags":["ioc","threat intel","ics","scada","otx"],"examples":["Is 185.220.101.45 associated with ICS attacks?","Enrich domain evil.com for OT context"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.01},{"id":"ot-cisa-advisory","name":"CISA ICS Advisory Feed","description":"Live CISA ICS-CERT security advisories filtered by vendor or sector.","tags":["cisa","advisory","ics","scada","vulnerability"],"examples":["Latest CISA advisories for Siemens","Recent ICS advisories for energy sector"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.02},{"id":"ot-exposure","name":"Asset Risk Verdict","description":"Asset-specific risk score and escalation verdict for OT/ICS devices. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Firmware-aware when firmware param provided.","tags":["risk-score","ics","scada","triage","escalation","asset-risk"],"examples":["What is the risk of internet-facing Siemens S7-1500 in energy sector?","Should I escalate this Schneider Modicon exposure?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.05},{"id":"ot-campaign","name":"Active ICS Campaign Tracker","description":"Active campaigns targeting a specific industrial sector right now. Returns campaign name, actor, start date, targeted geography, TTPs in use, and CVEs being exploited.","tags":["campaign","ics","scada","active-threat","sector-monitoring"],"examples":["What campaigns are active in the electric sector?","Active ICS campaigns targeting water utilities"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.05},{"id":"ot-delta","name":"Sector Change Feed","description":"What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes, not the full picture.","tags":["delta","change-feed","ics","scada","monitoring","cron"],"examples":["What changed in water sector this week?","New ICS CVEs in energy sector last 7 days"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.03},{"id":"ot-malware","name":"ICS Malware Encyclopedia","description":"Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted protocols, attributed actor, and MITRE ATT&CK for ICS techniques.","tags":["malware","ics","scada","pipedream","triton","industroyer"],"examples":["Profile PIPEDREAM malware","What protocols does TRITON target?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.02},{"id":"ot-brief","name":"Sector Threat Brief","description":"Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls.","tags":["brief","threat-brief","ics","scada","sector-report","risk-trend","compliance"],"examples":["Generate a 30-day threat brief for energy sector","What is the risk trend for water utilities?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.1},{"id":"ot-asn-profiling","name":"ICS Threat Actor ASN Infrastructure Profiling","description":"Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE), phishing kit links, bulletproof hosting indicators, and OT-specific blocking recommendations. ASN analysis reveals infrastructure clustering that survives IP/domain rotation.","tags":["asn","infrastructure","ics","threat-actor","bulletproof-hosting","c2","blocking"],"examples":["Is AS215540 used by ICS threat actors?","Profile ASN AS9009 for OT infrastructure links","Should I block AS29802 at my OT firewall?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.03},{"id":"ot-detection-artifacts","name":"ICS Detection Artifact Retrieval","description":"Returns YARA/Sigma detection rules for ICS malware families (PIPEDREAM, INDUSTROYER2, TRITON) and threat actors. Public corpus rules marked validated:true are safe for staging deployment. Synthesised rules carry validated:false. For automated threat hunting pipelines.","tags":["detection","yara","sigma","ics","threat-hunting","siem","pipedream","triton"],"examples":["Get YARA rules for PIPEDREAM","Sigma rules for SANDWORM TTPs","Detection artifacts for INDUSTROYER2"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.05},{"id":"ot-compliance-mapping","name":"Multi-Framework Compliance Gap Mapping","description":"Returns triggered controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic mapping shows which controls apply, compliance status, required action, and compensating controls. Optional framework= param filters to one standard. For automated compliance reporting agents.","tags":["compliance","nerc-cip","iec-62443","nist-csf","nca-otcc","nesa-ia","ics","gap-analysis","audit","cve"],"examples":["What NERC CIP controls does CVE-2023-38802 trigger?","IEC 62443 gaps for SANDWORM activity","NCA OTCC posture for XENOTIME activity"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.04},{"id":"ot-compliance-batch","name":"Aggregate Compliance Gap Assessment","description":"Rolls up compliance-gap mapping across multiple CVEs/threat actors in one call — deduplicated triggered controls, one aggregate severity rating (HIGH/MEDIUM/LOW/CLEAN), and a remediation summary. Same 11-framework coverage as ot-compliance-mapping. For agents triaging a batch of new advisories at once instead of one call per finding.","tags":["compliance","batch","nerc-cip","iec-62443","nist-csf","nca-otcc","nesa-ia","gap-analysis","audit"],"examples":["Batch-assess NESA gaps for these 5 CVEs from this week's advisories","Aggregate compliance severity for XENOTIME plus these 3 CVEs"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.2},{"id":"ot-threat-score","name":"Actor-Target Threat Score","description":"Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus live GDELT geopolitical tension and OFAC sanctions pressure signals. Not LLM-generated — the underlying score referenced by ot-risk-exposure and ot-action-conformance.","tags":["threat-score","risk-scoring","ics","capability","opportunity","intent","geopolitical","sanctions"],"examples":["What's SANDWORM's threat score against energy targets in Europe?","Score VOLTZITE's capability and intent against a Siemens/Schneider stack in GCC"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.04},{"id":"ot-precursor-ttp","name":"Precursor / Dwell-Time TTP Breakdown","description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup — no LLM in the classification path.","tags":["ttp-analysis","dwell-time","early-warning","mitre-attck","ics","reconnaissance"],"examples":["How much of SANDWORM's activity is pre-impact vs impact-stage?","Does XENOTIME give an early-warning window before disruption?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.04},{"id":"ot-root-cause-localization","name":"Statistical Anomaly Attribution","description":"Ranks which sensors most likely drove a reported OT/ICS anomaly by statistical deviation (z-score) from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM. A statistical approximation of the attribution goal in Oswal et al. 2025 (kernel SHAP + temporal convolution autoencoder) — not a trained model, no SHAP values computed.","tags":["anomaly-detection","root-cause","ics","scada","statistical","z-score"],"examples":["Which sensor caused this anomaly given these 5 tag histories?","Rank these 8 SCADA tags by deviation from baseline around the 14:32 event"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.15},{"id":"ot-threat-hunt-control-loop","name":"Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)","description":"Flags control-loop reconnaissance patterns and living-off-the-land/RMM-tool abuse from caller-submitted process and command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134) for the threat model, Dragos's control-loop mapping concept for the recon indicators. ADVISORY ONLY — never executes containment or any network action.","tags":["threat-hunting","advisory","rmm-abuse","living-off-the-land","ics","control-loop","keyword-matching"],"examples":["Flag any concerning patterns in these observed processes on an OT asset","Check this command history for living-off-the-land techniques"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.15},{"id":"ot-invariant-reachability","name":"Physical Invariant Check","description":"Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out over the same interval, via conservation of mass. Fully deterministic, no LLM. Loosely inspired by Barbhaya et al. 2025's physical-invariant residual check — not a reimplementation of their trained detection model. Flags inconsistency and direction; does not assert a specific cause.","tags":["physical-invariant","mass-balance","ics","scada","anomaly-detection","deterministic"],"examples":["Is this tank's level change consistent with its metered flows?","Check for a physical invariant violation on TANK_302 over the last minute"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.2},{"id":"ot-vendor-risk","name":"OT/ICS Third-Party Vendor Risk","description":"Supply-chain risk assessment for a specific OT/ICS vendor (e.g. Schneider Electric, Siemens, Rockwell Automation, ABB, Honeywell). Aggregates CVE, campaign, and threat actor mentions associated with the vendor and returns risk tier, confidence, and prescriptive supply-chain mitigation recommendations. Certain restricted-license third-party sources are excluded from analysis.","tags":["third-party-risk","supply-chain","ics","vendor-risk","vulnerability","cve"],"examples":["Assess supply-chain risk for Schneider Electric Modicon","What's the vendor risk for Siemens SIMATIC?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.15},{"id":"ot-mitigation-map","name":"D3FEND-Mapped Mitigation Guidance","description":"Maps MITRE ATT&CK for ICS techniques to MITRE D3FEND defensive countermeasures for a given threat actor, CVE, or technique ID. The technique-to-D3FEND mapping is always deterministic (local crosswalk); DeepSeek only selects the relevant technique when actor/CVE is given, and writes prescriptive architecture recommendations.","tags":["architecture","d3fend","mitre-attck","ics","mitigation","defense-in-depth"],"examples":["What D3FEND controls mitigate SANDWORM's TTPs?","Mitigation guidance for T0836","Architecture recommendations for CVE-2024-XXXXX in a Schneider Modicon environment"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.2},{"id":"ot-risk-exposure","name":"Board/GRC Portfolio Risk Aggregator","description":"Aggregates deterministic threat-scores across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written board-level executive summary (BLUF, ICD-203 language). Optional compliance_framework param noted qualitatively in the narrative. For vCISO agents and GRC/board-reporting automation — portfolio-level companion to ot-threat-score.","tags":["grc","board-report","risk-exposure","executive-summary","ics","portfolio-risk"],"examples":["What's our risk exposure in the GCC energy sector?","Board summary of ICS threats to our water utility in KSA"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.4},{"id":"ot-action-conformance","name":"Remediation Action Risk Gate","description":"Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as ot-threat-score, with auditable rules layered on top — no LLM in the decision path. For agents that need a governance checkpoint before executing high-impact actions.","tags":["governance","remediation","risk-gate","automation","ics","human-in-the-loop"],"examples":["Can I auto-block this IP linked to SANDWORM?","Should quarantining this host be human-reviewed first?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.12},{"id":"ot-ai-exposure","name":"AI/Agentic Copilot Attack Surface Lookup","description":"Deterministic lookup of a vendor's publicly documented AI/agentic copilot in their OT/ICS product line, its autonomy level (advisory vs agentic — the primary risk differentiator), and the MITRE ATLAS techniques that apply given its access level. Hand-verified mapping, ATLAS IDs confirmed directly against the live matrix. No LLM in the lookup path.","tags":["ai-security","agentic-ai","mitre-atlas","copilot","ics","supply-chain"],"examples":["Does Siemens have an AI copilot, and what's its attack surface?","Is Honeywell's AI platform advisory or agentic?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.2},{"id":"ot-ai-uplift","name":"Attacker AI-Uplift Exposure","description":"Assesses how much a general-purpose AI agent (Claude, GPT) lowers the skill/time barrier for an attacker to find and reach a vendor's OT-adjacent footprint. Grounded in Dragos's May 2026 'AI in the Breach' precedent, not frontier-model governance thresholds. Distinct from ot-ai-exposure, which looks up a vendor's OWN embedded AI copilot. DeepSeek-synthesised over CTI corpus plus caller-declared deployment context.","tags":["ai-uplift","ai-security","reconnaissance","ics","supply-chain","it-ot-boundary"],"examples":["How much does AI lower the attack barrier for Schneider Electric's Modicon line?","Assess AI-uplift exposure for an internet-facing, single-factor-auth Siemens gateway"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.2},{"id":"ot-ai-attack-feasibility","name":"LLM-Generated ICS Attack Feasibility","description":"Deterministic lookup against one specific empirical study (Cook et al., ACM TOPS 2026) testing whether off-the-shelf LLMs (GPT-4o, Gemini, DeepSeek, Qwen, LLaMA — Claude excluded by the paper's own authors due to stronger safety guardrails) can generate working attack code against real PLCs. Narrow scope: only 3 vendors tested, only network/register-tags techniques ever succeeded, 1.08% overall success rate. Distinct from ot-ai-exposure (vendor's own AI copilot) and ot-ai-uplift (open-ended reconnaissance-uplift synthesis).","tags":["ai-security","llm-attack-synthesis","mitre-ics","empirical-study","ics","plc"],"examples":["Can an off-the-shelf LLM generate a working attack for Brute Force I/O?","Which techniques from the Triton campaign are LLM-achievable?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.2},{"id":"ot-claim-reliability","name":"CTI Claim Reliability Scoring","description":"Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Flags constrained_generalization and caps confidence at low whenever no grounding text is found, rather than letting the model claim corroboration it doesn't have.","tags":["cti-reliability","evidence-verification","empirical-study","ics","confidence-scoring"],"examples":["How reliable is the claim that SANDWORM has pivoted to Gulf water utilities?","Check this actor-attribution claim against intel.db before I act on it"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.2},{"id":"ot-stix-coverage","name":"STIX Representability + Actionability Lookup","description":"Deterministic lookup grounded in Hahn, Krief, Rebori-Carretero, Puzis, Elyashar & Urlaub, 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering — answering what STIX sharing alone can't tell you. No LLM in the lookup path.","tags":["stix","threat-information-sharing","empirical-study","ics","detection-engineering"],"examples":["If SANDWORM shares T0836 activity via STIX, can I actually build a detection from it?","Does STIX have a way to represent Profibus command manipulation?"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.2},{"id":"ot-analyst-brief","name":"Analyst Brief","description":"BLUF-style decision-ready analyst brief with key judgments and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector.","tags":["bluf","synthesis","ics","decision-support"],"examples":["Give me a decision-ready brief on SANDWORM for energy","BLUF on VOLTZITE"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.12},{"id":"ot-vendor-risk-delta","name":"Vendor-Swap Risk Comparison","description":"Counterfactual comparison of two OT/ICS vendors' risk tiers, for pre-purchase or migration decisions.","tags":["vendor-risk","counterfactual","supply-chain","procurement","ics"],"examples":["Is switching from Siemens to Schneider Electric lower risk?","Compare vendor risk: Rockwell vs Honeywell"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.2},{"id":"ot-sighting-submit","name":"Submit OT Sighting","description":"Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment, feeding the correlation corpus without storing an org identifier.","tags":["crowdsourced","sighting","ioc","ttp","ics"],"examples":["Report an IOC sighting in our energy-sector OT network","Submit a TTP observation from KSA"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.05},{"id":"ot-gcc-bulletin","name":"GCC OT Threat Sitrep (Public Bulletin)","description":"Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish.","tags":["sitrep","gcc","public-bulletin","ics"],"examples":["Latest GCC OT threat bulletin","GCC sitrep for July 2026"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.01},{"id":"ot-report","name":"Threat Actor Report","description":"Synthesised Markdown threat actor report for ICS/OT — executive summary, TTPs, campaigns, malware, and recommended actions. TLP: WHITE.","tags":["report","synthesis","ics","actor"],"examples":["Full threat report on CHERNOVITE for energy sector","Report on SANDWORM"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.25},{"id":"ot-dossier","name":"Deep Actor Dossier","description":"Deep actor intelligence dossier — full profile, infrastructure, IOC table, detection rules, and kill chain mapping. Most comprehensive single-call artifact available.","tags":["dossier","synthesis","ics","actor"],"examples":["Deep dossier on SANDWORM","Full IOC and infra profile for XENOTIME"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.35},{"id":"ot-sitrep","name":"Sector Situation Report","description":"30-day sector situation report — threat landscape, top actors, new advisories, what changed, compliance posture, and recommended priorities.","tags":["sitrep","synthesis","ics","sector"],"examples":["30-day sitrep for energy sector","Weekly briefing for water sector"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.35},{"id":"ot-article","name":"CTI Article (Publication-Ready)","description":"Publication-ready CTI article (~700 words), journalist-style with headline, lede, body, ATT&CK context, defanged IOCs, and TLP marking.","tags":["article","content","synthesis","ics"],"examples":["Write a CTI article on CHERNOVITE","Publication-ready piece on CVE-2024-12345"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.45},{"id":"ot-linkedin","name":"LinkedIn Post","description":"LinkedIn post for a CTI/ICS security audience — hook line, intelligence bullets, call to action, and hashtags. Ready to publish.","tags":["linkedin","content","synthesis","ics"],"examples":["LinkedIn post about VOLTZITE","Social post on CVE-2024-12345"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.15},{"id":"ot-xpost","name":"X/Twitter Thread","description":"X/Twitter thread (5-7 posts) for an ICS actor or CVE — hook, intel posts with ATT&CK IDs, mitigation post, and hashtag post.","tags":["twitter","x","content","synthesis","ics"],"examples":["X thread about XENOTIME","Twitter thread on CVE-2024-12345"],"inputModes":["application/json"],"outputModes":["application/json"],"price_usd":0.1}],"responseSigning":{"address":"0x91eBb2c95e4C5A2728d4D8C1e4992E9C83eb8bF3","scheme":"ot-intel-sig/1 (RFC8785-JCS + SHA-256 + EIP-191)","keyInfo":"https://ot-intel.daligence.com/.well-known/ot-intel-signer.json"}}