# OT Intel API — ICS/SCADA Threat Intelligence

## What This API Does
OT Intel monitors and enriches threat intelligence specifically for Operational Technology (OT)
and Industrial Control System (ICS) environments: SCADA, PLC, HMI, DCS, RTU, historian, and
safety instrumented systems (SIS). All data is AI-enriched by DeepSeek with OT-adjusted severity
scoring, cyber-physical impact assessment, MITRE ATT&CK for ICS technique mapping, and
CISA KEV status. Pay per call in USDC on Base mainnet via x402.
No API key. No account. No subscription.

## Intelligence Sources (4-layer enrichment)
Every response synthesises four layers of intelligence:
1. Live feeds: MITRE ATT&CK for ICS STIX bundle, CISA ICS-CERT advisories, NVD, AlienVault OTX, AbuseIPDB
2. OT Intel DB: curated knowledge base of 300+ structured records extracted from published research
   by Dragos, Claroty Team82, Nozomi Networks Labs, and ESET — updated weekly. Covers campaign
   timelines, CVE exploitation context, actor TTPs, IOC attribution, and field-tested mitigations.
3. DeepSeek LLM: synthesises all sources into structured, OT-operator-ready assessments
4. Dragos live threat pages: real-time actor profile data from dragos.com/threat-groups

Data sources: MITRE ATT&CK for ICS, CISA ICS-CERT, NVD, AlienVault OTX, AbuseIPDB,
Dragos threat intelligence, Claroty Team82 research, Nozomi Networks Labs, ESET WeLiveSecurity,
DeepSeek LLM enrichment.

Use cases: industrial SOC automation, OT vulnerability management, ICS threat intelligence pipelines,
NERC CIP, IEC 62443, NIST CSF, Saudi NCA OTCC, and UAE NESA IA compliance mapping, critical infrastructure protection.

When OT-Intel-DB appears in data_sources[], the response includes grounded intelligence from
published vendor research — not just LLM inference. Responses with OT-Intel-DB will contain
richer campaign context, confirmed CVE exploitation history, and field-tested mitigations.

## Base URL
https://ot-intel.daligence.com

## Authentication
x402 micropayment protocol. Include a valid X-PAYMENT header with each request.
Payment: USDC on Base mainnet (eip155:8453). Facilitator: CDP (api.cdp.coinbase.com).

## Errors are not charged (changed 31 October 2026)
A paid call that cannot give a result returns an HTTP error, and x402 does not settle it:
- 400 — a required parameter is missing or a value is invalid (missing_required_params, invalid_*)
- 404 — the item does not exist (e.g. cve_not_found, actor_not_found)
- 503 — an upstream source or the model failed; retry later (e.g. *_lookup_failed)
The body is JSON: { "error": "...", "message": "...", "charged": false }.
Before this date these errors came back as HTTP 200 and were charged. If your client reads
the "error" field of 200 responses, also handle 4xx and 5xx. Results, including honest empty
results with a no_data_statement, are still 200 and charged.

---

## Endpoints

### GET /ot/cve — OT-Contextualised CVE Triage  ($0.02 USDC)
CVE lookup enriched for ICS/SCADA environments. Returns OT-adjusted severity,
cyber-physical impact, affected ICS layer, compensating controls that avoid downtime,
patch feasibility, and CISA KEV status. Covers PLCs, DCS, HMI, RTU, engineering
workstations, and safety instrumented systems (SIS).
When the CVE appears in published Dragos/Claroty/Nozomi research, the response includes
confirmed exploitation context and actor attribution from the OT Intel DB.

**Query parameters:**
- id  (string, required) — CVE identifier, e.g. CVE-2023-38802

**Response fields:**
- cve_id                  (string)  — CVE identifier
- summary                 (string)  — NVD description
- cvss_score              (number)  — base CVSS score (NVD)
- severity                (string)  — critical | high | medium | low
- ot_severity             (string)  — OT-adjusted severity (may differ from IT baseline)
- ot_layer                (string)  — field_device | hmi | scada_server | historian | dcs | rtu | safety_system
- cyber_physical_impact   (string)  — process_disruption | physical_damage | safety_system_bypass | none
- kev_status              (string)  — in_kev | not_in_kev
- kev_due_date            (string)  — CISA KEV remediation deadline (if applicable)
- epss                    (object)  — FIRST EPSS: { score (0-1, probability of exploitation in the next 30 days),
                                      percentile (0-1), date, source } or null (then epss_error says why)
- patch_feasibility       (string)  — feasible | risky | not_recommended
- compensating_controls[] (array)   — OT-safe mitigations that avoid downtime
- recommended_action      (string)  — prioritised action for OT operators
- affected_vendors[]      (array)   — vendor names
- references[]            (array)   — NVD and vendor advisory URLs
- data_sources[]          (array)   — sources used: NVD, CISA-KEV, OT-Intel-DB, DeepSeek-CTI-Analysis

**Example call:**
GET https://ot-intel.daligence.com/ot/cve?id=CVE-2023-38802

**Example response:**
{
  "cve_id": "CVE-2023-38802",
  "summary": "FRR BGP daemon crash via malformed BGP UPDATE packet",
  "cvss_score": 7.5,
  "severity": "high",
  "ot_severity": "critical",
  "ot_layer": "scada_server",
  "cyber_physical_impact": "process_disruption",
  "kev_status": "not_in_kev",
  "patch_feasibility": "feasible",
  "compensating_controls": ["network segmentation", "BGP route filtering", "disable unused BGP peers"],
  "recommended_action": "Apply vendor patch during next maintenance window; apply network controls immediately.",
  "affected_vendors": ["FRR Project"],
  "references": ["https://nvd.nist.gov/vuln/detail/CVE-2023-38802"],
  "data_sources": ["NVD", "CISA-KEV", "DeepSeek-CTI-Analysis"]
}

---

### GET /ot/device — OT Device Security Profile  ($0.05 USDC)
Security profile for an OT device by vendor and model: the device's CVEs from NVD (newest first),
its CISA ICS advisories (full CSAF history, advisories naming the model first), and a hardening
profile written by a model (DeepSeek) from public ICS research — default-credential risk,
OT protocols at risk, hardening steps. The profile is model output (profile_provenance), not a
scan: this endpoint does not measure internet exposure.

**Query parameters:**
- vendor  (string, required) — siemens | schneider | rockwell | honeywell | ge | unitronics | beckhoff | abb | emerson
- model   (string, optional) — device model, e.g. s7-1200 | modicon-m340 | controllogix | vision.
  With a model, NVD is searched for the model name; without, for the vendor.
- firmware (string, optional) — with model: each CISA advisory gets asset_match (see /ot/advisory)

**Response fields:**
- query                      (object) — { vendor, model }
- default_credential_risk    (object) — { risk: critical|high|medium|low|unknown, note }   (model-written)
- known_default_credentials  (object) — { exists, details }                                 (model-written)
- ot_protocols_at_risk[]     (array)  — e.g. "Modbus TCP (502)", "S7comm (102)"             (model-written)
- internet_exposure_risk     (string) — the model's general estimate, not a measurement     (model-written)
- hardening_steps[]          (array)  — 3-5 actionable steps                                 (model-written)
- recommended_action         (string) — the single most important step                      (model-written)
- profile_provenance         (string) — model_synthesised | default_text
- recent_cves[]              (array)  — the 10 newest NVD CVEs: { cve_id, cvss_score, cvss_version, severity, published, summary }
- nvd                        (object) — { keyword, cves_matched (CVEs naming the vendor), keyword_matches, truncated }
- cisa_advisories[]          (array)  — up to 5: { id, title, url, published, cvss_max, severity }
- advisory_source            (string) — csaf | rss
- data_sources[]             (array)  — NVD, CISA-ICS-CERT, DeepSeek-CTI-Analysis, OT-Intel-DB, as used

**Example call:**
GET https://ot-intel.daligence.com/ot/device?vendor=unitronics&model=vision

---

### GET /ot/actor — ICS Threat Actor Profile  ($0.03 USDC)
ICS/APT threat actor profiles grounded in published vendor research. Fetches live from
MITRE ATT&CK for ICS STIX bundle, Dragos threat pages, and the OT Intel DB (Dragos/Claroty/
Nozomi/ESET published reports). Returns MITRE ATT&CK for ICS technique mappings, confirmed
ICS malware with descriptions, campaign timelines, targeted sectors, attribution, physical
impact assessment, and OT-specific detection recommendations.
Actors with OT-Intel-DB coverage return richer profiles with confirmed campaign dates,
exploitation history, and field-validated TTPs — not just training data inference.

**Query parameters:**
- name  (string, required) — actor name or alias, e.g. SANDWORM | VOLTZITE | XENOTIME | Volt+Typhoon

Alias lookup supported:
  Volt Typhoon -> VOLTZITE | APT44 -> SANDWORM | TEMP.Veles -> XENOTIME
  Seashell Blizzard -> SANDWORM | Kamacite -> SANDWORM subgroup

Known actors: SANDWORM, VOLTZITE, XENOTIME, KAMACITE, ELECTRUM, CHERNOVITE, BENTONITE,
ERYTHRITE, TALONITE, BAUXITE, PETROVITE, GRAPHITE, KOSTOVITE, LAURIONITE, MAGNALLIUM,
WASSONITE, CHRYSENE, VANADINITE, DYMALLOY, RASPITE, STIBNITE, GANANITE, ALLANITE, PARISITE

**Response fields:**
- canonical_name    (string) — primary actor name
- aliases[]         (array)  — known aliases across vendors
- attribution       (string) — attributed nation-state and unit if known
- physical_impact   (string) — CONFIRMED DESTRUCTIVE | ASSESSED HIGH | POSSIBLE | UNKNOWN
- targeted_sectors[] (array) — industrial sectors targeted
- attack_techniques[] (array) — MITRE ATT&CK for ICS technique mappings with IDs
- known_malware[]   (array)  — ICS malware with descriptions
- recommended_detections[] (array) — OT-specific SOC detection recommendations
- last_known_reporting (object) — most recent published reporting with date and source
- data_sources[]    (array)  — includes OT-Intel-DB when published research was used

**Example call:**
GET https://ot-intel.daligence.com/ot/actor?name=VOLTZITE

**Example response:**
{
  "canonical_name": "VOLTZITE",
  "aliases": ["VOLTZITE", "Volt Typhoon", "Bronze Silhouette"],
  "attribution": "China-nexus — assessed state-sponsored",
  "physical_impact": "ASSESSED HIGH — persistent access to US electric grid for pre-positioning",
  "targeted_sectors": ["electric", "telecommunications", "water"],
  "attack_techniques": [
    {"id": "T0859", "name": "Valid Accounts", "tactic": "Initial Access"},
    {"id": "T0812", "name": "Default Credentials", "tactic": "Initial Access"}
  ],
  "known_malware": [],
  "recommended_detections": ["Monitor for LOTL techniques on OT-adjacent hosts"],
  "last_known_reporting": {"date": "2025-Q1", "source": "Dragos", "assessment": "ACTIVE"},
  "data_sources": ["MITRE-ATT&CK-ICS", "Dragos-Threat-Intelligence", "OT-Intel-DB", "DeepSeek-CTI-Analysis"]
}

---

### GET /ot/actor/sector — Actors by Industrial Sector  ($0.03 USDC)
All ICS threat actors targeting a specific industrial sector. Live from MITRE ATT&CK for ICS,
enriched with campaign context from the OT Intel DB covering published Dragos/Claroty/Nozomi research.

**Query parameters:**
- sector  (string, required) — energy | water | manufacturing | oil-and-gas | chemical | transportation | nuclear

**Response fields:**
- sector        (string) — queried sector
- total_actors  (number) — count of actors targeting this sector
- actors[]      (array)  — list of actor summary objects
  - actor_name      (string) — primary name
  - attribution     (string) — attributed country
  - physical_impact (string) — CONFIRMED DESTRUCTIVE | LIKELY | POSSIBLE | UNKNOWN
  - activity_status (string) — ACTIVE | DORMANT
- data_sources[] (array) — includes OT-Intel-DB when campaign intel was used

**Example call:**
GET https://ot-intel.daligence.com/ot/actor/sector?sector=energy

---

### GET /ot/ioc — IOC Enrichment with OT Campaign Context  ($0.01 USDC)
IOC enrichment with ICS/OT campaign context. Queries AlienVault OTX, AbuseIPDB, and
the OT Intel DB for published IOC attribution before DeepSeek synthesis. Returns verdict
on whether the IOC is linked to OT-targeting campaigns (VOLTZITE, SANDWORM, XENOTIME etc.).
Cheapest endpoint — designed for high-volume SOC triage pipelines.

**Query parameters:**
- value  (string, required) — indicator value, e.g. 185.220.101.45 | malicious-domain.com
- type   (string, required) — ip | domain

**Response fields:**
- ioc                        (string)  — queried indicator
- type                       (string)  — ip | domain
- otx                        (object)  — AlienVault OTX data
  - reputation               (number)  — OTX reputation score
  - pulse_count              (number)  — number of OTX threat feeds referencing this IOC
  - ot_tagged                (boolean) — true if referenced in ICS/SCADA/Modbus/DNP3 tagged feeds
- abuseipdb                  (object)  — AbuseIPDB data (IP only)
  - abuse_confidence_score   (number)  — 0-100
  - isp                      (string)  — ISP name
  - tor_node                 (boolean) — is this a known Tor exit node
  - total_reports            (number)  — total abuse reports
- deepseek_cti               (object)  — DeepSeek CTI enrichment
  - known_threat_actor       (string)  — attributed actor or "unknown"
  - campaign_context         (string)  — description of associated campaign
  - confidence               (string)  — high | medium | low
- verdict                    (string)  — OT_TARGETED_CAMPAIGN | GENERIC_THREAT | BENIGN | UNKNOWN
- data_sources[]             (array)   — includes OT-Intel-DB when IOC matched published research

**Example call:**
GET https://ot-intel.daligence.com/ot/ioc?value=185.220.101.45&type=ip

---

### GET /ot/advisory — CISA ICS-CERT Advisories  ($0.02 USDC)
CISA ICS advisories by vendor or sector, from CISA's full CSAF 2.0 history (every OT advisory since
2010, github.com/cisagov/CSAF), newest first. CVSS scores come from the advisory itself; a CVE the
advisory gives no score is looked up in NVD (at most 3 per call, cached). Falls back to the CISA RSS
feed (latest advisories only) when the CSAF repository is unreachable; source_feed says which was used.
Includes related_intel when the OT Intel DB has published research on the vendor or sector.

Vendor: matched (whole words) on the title and vendor of every advisory.
Sector: matched on CISA's "critical infrastructure sectors" of the 60 newest advisories
(after since, if given). With both, the vendor decides; each item lists its sectors.

**Query parameters:**
- vendor  (string, optional) — siemens | schneider | rockwell | honeywell | ge | abb | emerson | yokogawa | omron | mitsubishi
- sector  (string, optional) — energy | water | manufacturing | oil-and-gas | chemical | healthcare | transportation | nuclear
- since   (string, optional) — YYYY-MM-DD; only advisories first published on or after this date
- model   (string, optional) — your device model, e.g. s7-1500 | modicon-m340. Advisories naming it come first,
            and each advisory gets asset_match (below), read from CISA's per-product version data
- firmware (string, optional) — your firmware version, e.g. 2.9.2 | SV3.60; used with model
- limit   (number, optional) — page size, default 10, max 25
One of vendor or sector is required.

**Response fields:**
- count          (number) — advisories returned
- source_feed    (string) — csaf | rss
- coverage       (object) — what was searched (advisories_in_feed, searched, since, unreadable, nvd_lookups, nvd_filled, nvd_skipped)
- advisories[]   (array)
  - id           (string) — CISA advisory ID, e.g. ICSA-26-302-03 (ICSMA- for medical)
  - title, url (CISA page), csaf_url, published, updated, summary
  - vendors[]    (array)  — vendors named in the advisory's product tree
  - vendor_match (boolean) — the queried vendor is in the title or vendors (vendor queries)
  - cvss_max     (number) — highest CVSS in the advisory; cvss_max_source CISA-CSAF | NVD
  - severity, ot_severity, ot_layer, ot_sectors
  - critical_infrastructure_sectors[], countries_deployed[] — as CISA states them
  - cves[]       (array)  — CVE IDs covered
  - cve_scores[] (array)  — { id, cvss, cvss_version, cvss_source, cwe } per CVE
  - triage_links (object) — /ot/cve and /ot/patch for each CVE (vendor queries)
  - asset_match  (object) — with ?model=: { match, basis, products[], fixes[] } where match is
      affected         your firmware is in an affected version range of the model itself
      related_product  only a variant, module or accessory of the model is affected: check whether you run it
      not_affected     your firmware is outside every affected range listed for the model
      version_unknown  no firmware given, or a range could not be compared (never guessed as not affected)
      model_not_listed no product in the advisory names the model
- asset_summary  (object) — with ?model=: count of advisories per match value
- related_intel  (string) — published research from the OT Intel DB (when available)
- data_sources[] (array)  — CISA-ICS-CERT, NVD when used, OT-Intel-DB when used
- no_data_statement (string) — when nothing matched, with what was searched

**Example call:**
GET https://ot-intel.daligence.com/ot/advisory?vendor=schneider&limit=5

---

### GET /ot/patch — OT Patch Feasibility Assessment  ($0.05 USDC)
Full patch feasibility assessment for a CVE in an OT/ICS environment. Returns patch
availability, vendor advisory URLs, OT-safe workarounds, patch complexity per ICS layer,
estimated downtime, safe-to-patch-live flag, recommended maintenance window, deployment
strategy, CISA KEV status, and risk-vs-disruption score (1-10 with rationale).
When the CVE appears in published Dragos/Claroty/Nozomi research, field-tested workarounds
and exploitation context from those reports are included in the assessment.

**Query parameters:**
- id  (string, required) — CVE identifier, e.g. CVE-2021-34527

**Response fields:**
- cve_id                      (string)  — CVE identifier
- patch_available             (boolean) — vendor patch exists
- vendor_advisory_url         (string)  — link to vendor patch page
- kev_status                  (string)  — in_kev | not_in_kev
- patch_complexity            (string)  — low | medium | high
- estimated_downtime_minutes  (number)  — estimated downtime to apply patch
- safe_to_patch_live          (boolean) — whether patch can be applied without process shutdown
- recommended_window          (string)  — suggested maintenance window type
- deployment_strategy         (string)  — phased | immediate | defer_with_controls
- ot_safe_workarounds[]       (array)   — mitigations that avoid downtime
- risk_vs_disruption_score    (number)  — 1-10 score balancing CVE risk against patching disruption
- score_rationale             (string)  — explanation of the score
- data_sources[]              (array)   — includes OT-Intel-DB when field intelligence was used

**Example call:**
GET https://ot-intel.daligence.com/ot/patch?id=CVE-2021-34527

---

---

### GET /ot/exposure — Asset Risk Score + Verdict  ($0.05 USDC)
A computed, reproducible risk verdict for one asset: NVD CVEs that name the model (all of them,
newest first; firmware is not matched, so some may be fixed in your version — see nvd),
the network position, and published intel in OT Intel's own database. The score is computed,
not written by a model; every input is returned in score_inputs, so you can recompute it.
A model writes only the one-sentence narrative and the generic sector actor list, both labelled.

Score = min(100, max(max_effective_cvss × 10 × network_multiplier, network_floor) + intel_points)
- effective_cvss:     the CVE's CVSS, or half of it when the CVE is more than 3 years old
                      (firmware is not matched, so an old CVE is probably fixed in the running version)
- network_multiplier: internet-facing 1.5 · dmz 1.2 · lan-only 0.8 · air-gapped 0.5
- network_floor:      internet-facing 60 · dmz 35 · lan-only 15 · air-gapped 5
- intel_points:       +10 if OT Intel's DB has published intel naming the vendor, +5 for the sector
- critical needs current evidence: a CVE from the last 3 years with CVSS ≥ 9, or an internet-facing
  asset with a recent CVE ≥ 7; otherwise the score is capped at 79 (score_inputs.uncapped_score keeps the sum)
- risk_level: critical ≥ 80 · high ≥ 60 · medium ≥ 40 · low

**Query parameters:**
- vendor   (string, required) — e.g. siemens | schneider | rockwell | ge | honeywell
- model    (string, required) — e.g. s7-1500 | modicon-m340 | controllogix
- sector   (string, required) — energy | water | manufacturing | oil-and-gas | chemical | nuclear
- network  (string, required) — internet-facing | dmz | lan-only | air-gapped
- firmware (string, optional) — firmware version e.g. 2.9.2

**Response fields:**
- vendor, model, sector, network, firmware — the query
- risk_score              (number)  — 0-100, computed (formula above)
- risk_level              (string)  — critical | high | medium | low
- escalate                (boolean) — score ≥ 80 (only possible when critical is allowed, see above)
- recommended_action      (string)  — isolate (internet-facing) | patch (effective CVSS ≥ 7) | review (score ≥ 40) | monitor
- active_cves             (number)  — NVD CVEs naming the model, CVSS ≥ 7, published in the last 3 years
- active_campaigns        (number)  — published sector records in OT Intel's DB (not confirmed campaigns against this asset)
- confidence              (string)  — medium when at least one CVE has a CVSS score, else low
- score_inputs            (object)  — every input to the score
- nvd                     (object)  — keyword searched, cves_matched (CVEs naming the vendor in description or CPE), keyword_matches, truncated, firmware_matched (false)
- recent_cves[]           (array)   — the 10 newest matching CVEs { id, published, cvss, cvss_version, severity }
- scoring                 (string)  — "deterministic"
- provenance              (string)  — "computed"
- top_threat              (string)  — one-sentence narrative
- narrative_provenance    (string)  — model_synthesised | computed
- sector_actors[]         (array)   — actors publicly reported in the sector (model-written; not evidence against this asset)
- threat_actors[]         (array)   — same list as sector_actors (kept for compatibility)
- ttl_seconds             (number)  — cache TTL — when to re-query
- data_sources[]          (array)   — sources used

**Example call:**
GET https://ot-intel.daligence.com/ot/exposure?vendor=siemens&model=s7-1500&firmware=2.9.2&sector=energy&network=internet-facing

---

### GET /ot/campaign — Active Campaign Tracker  ($0.05 USDC)
Active campaigns targeting a specific industrial sector right now. No free equivalent —
MITRE ATT&CK provides historical actor profiles but not live campaign status. Returns
campaign name, attributed actor, start date, targeted geography, TTPs in use, associated
CVEs being exploited, and confidence level. Ideal for threat briefing agents and sector
monitoring workflows.

**Query parameters:**
- sector  (string, required) — energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical
- status  (string, optional) — active (default) | all

**Response fields:**
- sector              (string)  — queried sector
- status              (string)  — active | all
- campaign_count      (number)  — number of campaigns found
- campaigns[]         (array)   — list of campaign objects
  - name              (string)  — campaign or operation name
  - actor             (string)  — attributed threat actor
  - status            (string)  — active | historical
  - start_date        (string)  — approximate start date
  - targeted_geography[] (array) — regions or countries targeted
  - ttps_in_use[]     (array)   — MITRE ATT&CK for ICS technique IDs
  - exploited_cves[]  (array)   — CVE IDs actively exploited in this campaign
  - confidence        (string)  — high | medium | low
- data_sources[]      (array)   — sources used
- freshness           (string)  — ISO 8601 timestamp

**Example call:**
GET https://ot-intel.daligence.com/ot/campaign?sector=electric&status=active

---

### GET /ot/delta — Sector Change Feed  ($0.03 USDC)
What is NEW for a sector since the last N days. Returns only new CVEs, new actor activity,
and new CISA advisories — not the full picture. Designed for scheduled monitoring agents
running on a cron: call daily at $0.03, get only what changed, route new items to downstream
tools. Eliminates redundant reprocessing of known intelligence.

**Query parameters:**
- sector  (string, required) — energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical | transportation
- days    (number, optional) — lookback window in days, default 7, max 30

**Response fields:**
- sector              (string)  — queried sector
- since               (string)  — ISO 8601 start of lookback window
- new_cves[]          (array)   — CVEs published in lookback window affecting this sector
  - id                (string)  — CVE identifier
  - cvss              (number)  — CVSS base score
  - ot_severity       (string)  — OT-adjusted severity
  - affected_vendors[] (array)  — vendor names
- new_advisories[]    (array)   — new CISA ICS-CERT advisories in window, from CISA's CSAF files: {id, title, published, cvss_max, severity, ot_severity}; cvss_max null and severity "unknown" when no score exists
- advisory_source     (string)  — csaf | rss (CSAF unreachable: latest RSS items, usually unscored) | null (both unreachable)
- new_actor_activity[] (array)  — new or updated actor activity for this sector
- net_change          (string)  — summary e.g. "3 new critical items"
- data_sources[]      (array)   — sources used
- freshness           (string)  — ISO 8601 timestamp

**Example call:**
GET https://ot-intel.daligence.com/ot/delta?sector=water&days=7

---

### GET /ot/malware — ICS Malware Encyclopedia  ($0.02 USDC)
Structured profiles of known ICS malware: PIPEDREAM, INDUSTROYER2, TRITON, CRASHOVERRIDE,
FROSTYLOOP, BLACKENERGY, and others. MITRE ATT&CK has sparse coverage — this endpoint returns
programmatically structured data from published Dragos, ESET, and Claroty research. Returns
capabilities, targeted protocols, attributed actor, affected vendors, detection signatures,
and MITRE ATT&CK for ICS technique mappings.

**Query parameters:**
- name  (string, required) — malware name e.g. PIPEDREAM | TRITON | INDUSTROYER2 | CRASHOVERRIDE | FROSTYLOOP

**Response fields:**
- name                    (string)  — canonical malware name
- aliases[]               (array)   — known alternate names e.g. PIPEDREAM = INCONTROLLER
- attributed_actor        (string)  — threat actor attributed with this malware
- targeted_protocols[]    (array)   — ICS protocols targeted e.g. Modbus, OPC UA, CODESYS
- affected_vendors[]      (array)   — vendor names affected
- capabilities[]          (array)   — capability categories: discovery | lateral_movement | disruption | destruction
- first_seen              (string)  — year or date of first known use
- detection_signatures[]  (array)   — detection strings or YARA rule references
- mitre_techniques[]      (array)   — MITRE ATT&CK for ICS technique IDs
- confidence              (string)  — high | medium | low
- data_sources[]          (array)   — sources used

**Example call:**
GET https://ot-intel.daligence.com/ot/malware?name=PIPEDREAM

---

### GET /ot/brief — Sector Threat Brief  ($0.10 USDC)
Complete structured 30-day threat picture for an industrial sector. One call replaces 5+
chained calls and a synthesis step. Returns active actors, new CVEs, active campaigns, top
advisories, and a risk trend direction — the one field no free source provides. Agents running
recurring reporting workflows branch on risk_trend (increasing/stable/decreasing) to decide
whether to escalate to a human. Highest-value endpoint for reporting and compliance pipelines.

**Query parameters:**
- sector  (string, required) — energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical | transportation
- period  (number, optional) — lookback days, default 30

**Response fields:**
- sector                  (string)  — queried sector
- period_days             (number)  — lookback window
- active_actors[]         (array)   — actor names with confirmed activity in period
- new_cves                (number)  — count of new CVEs affecting this sector
- critical_cves           (number)  — count of critical-severity CVEs
- active_campaigns        (number)  — count of active campaigns
- top_advisories[]        (array)   — top CISA advisories in period, from CISA's CSAF files: {id, title, published, cvss_max, severity, ot_severity}
- advisory_source         (string)  — csaf | rss | null (both unreachable)
- risk_trend              (string)  — increasing | stable | decreasing
- risk_trend_rationale    (string)  — one sentence explaining the trend
- recommended_actions[]   (array)   — top 3 prioritised actions for this sector
- confidence              (string)  — high | medium | low
- data_sources[]          (array)   — sources used
- freshness               (string)  — ISO 8601 timestamp

**Example call:**
GET https://ot-intel.daligence.com/ot/brief?sector=energy&period=30

---

### GET /ot/asn — ICS Threat Actor ASN Infrastructure Profiling  ($0.03 USDC)
Profiles an Autonomous System Number (ASN) for ICS threat actor infrastructure use.
ICS threat actors reuse ASNs for staging, C2, and lateral movement — ASN analysis
reveals infrastructure clustering across campaigns that survive IP/domain rotation.
Returns known ICS actor associations, bulletproof hosting indicators, phishing kit
links, abuse reputation signals, and OT-specific blocking recommendations.
Grounded in OT Intel DB records from Dragos, Claroty, Nozomi, and ESET research
when the ASN appears in published ICS campaign reporting.

**Query parameters:**
- asn   (string, required) — ASN identifier e.g. AS215540 | AS9009 | AS29802
- org   (string, optional) — org name fragment for lookup e.g. "hivelocity" | "m247"

**Response fields:**
- asn                         (string)  — queried ASN e.g. AS215540
- org_name                    (string)  — registered organisation name
- ics_actor_associations[]    (array)   — ICS/OT threat actors observed using this ASN
- phishing_kit_associations[] (array)   — AiTM/phishing kits linked to this ASN (e.g. Tycoon2FA)
- abuse_categories[]          (array)   — bulletproof_hosting | c2 | phishing | staging | reconnaissance
- bulletproof_indicator       (boolean) — true if ASN shows low takedown responsiveness
- blocking_recommendation     (string)  — BLOCK | MONITOR | REVIEW | ALLOW
- waf_rule_hint               (string)  — AWS WAF / Cloudflare rule syntax for this ASN
- ics_campaign_context        (string)  — narrative from OT Intel DB if present
- confidence                  (string)  — high | medium | low
- data_sources[]              (array)   — sources used

**Example call:**
GET https://ot-intel.daligence.com/ot/asn?asn=AS215540

**Example response:**
{
  "asn": "AS215540",
  "org_name": "GLOBAL CONNECTIVITY SOLUTIONS LLP",
  "ics_actor_associations": ["SANDWORM", "VOLTZITE"],
  "phishing_kit_associations": ["Tycoon2FA", "NakedPages", "Sneaky2FA"],
  "abuse_categories": ["bulletproof_hosting", "phishing", "c2"],
  "bulletproof_indicator": true,
  "blocking_recommendation": "BLOCK — no legitimate ICS vendor or operator traffic expected",
  "waf_rule_hint": "AWS WAF AsnMatchStatement: [215540]",
  "ics_campaign_context": "AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) appears in Sekoia AiTM analysis as preferred ASN for Tycoon2FA authentication relay servers targeting industrial sector credentials.",
  "confidence": "high",
  "data_sources": ["OT-Intel-DB", "Dragos-Threat-Intelligence", "DeepSeek-CTI-Analysis"]
}

---

### GET /ot/detection — ICS Detection Artifact Retrieval  ($0.05 USDC)
Returns YARA/Sigma/Snort detection rules for an ICS malware family or threat actor.
Rules sourced from public corpus (Florian Roth signature-base, CISA advisories) are
marked validated:true and safe for staging. DeepSeek-synthesised rules carry
validated:false and require lab testing before production deployment. Designed for
automated threat hunting pipelines that commit rules to SIEMs and EDRs.

**Query parameters:**
- target (string, required) — malware or actor name e.g. PIPEDREAM | INDUSTROYER2 | TRITON | SANDWORM | CHERNOVITE
- format (string, optional) — yara | sigma | snort | all (default: all)

**Response fields:**
- target                (string)  — queried malware/actor name
- artifact_type         (string)  — malware | actor
- signatures[]          (array)   — rule objects: type, rule_name, raw_rule, target_layer, validated, source, ot_safe_note
- validated_count       (number)  — count of signatures sourced from public corpus
- synthesised_count     (number)  — count of DeepSeek-synthesised signatures
- ot_safe_validation    (string)  — narrative on how many rules are lab-tested vs need testing
- data_sources[]        (array)   — sources used

**Example call:**
GET https://ot-intel.daligence.com/ot/detection?target=PIPEDREAM

**Example response:**
{
  "target": "PIPEDREAM",
  "artifact_type": "malware",
  "signatures": [{
    "type": "YARA",
    "rule_name": "PIPEDREAM_INCONTROLLER_Loader",
    "raw_rule": "rule PIPEDREAM_INCONTROLLER_Loader { meta: ... strings: ... condition: ... }",
    "target_layer": "engineering_workstation",
    "validated": false,
    "source": "manual",
    "ot_safe_note": "Synthesised from CISA advisory AA22-103A. Test against OT baseline before SIEM deployment."
  }],
  "validated_count": 0,
  "synthesised_count": 1,
  "ot_safe_validation": "0 of 1 rules sourced from public corpus. Rules with validated:false require lab testing before production deployment.",
  "data_sources": ["OT-Intel-DB", "DeepSeek-CTI-Analysis"]
}

---

### GET /ot/compliance — Multi-Framework Compliance Gap Mapping  ($0.04 USDC)
Returns triggered compliance controls for a CVE or threat actor across 11 frameworks:
NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG,
Saudi NCA OTCC, and UAE NESA IA. Deterministic table lookup — LLM only adds
compensating control prose. Designed for automated compliance reporting agents:
call when a new advisory drops, generate gap report, route to compliance team.

**Query parameters:**
- cve_id    (string, optional) — CVE identifier e.g. CVE-2023-38802. At least one of cve_id or actor is required.
- actor     (string, optional) — threat actor name e.g. SANDWORM | VOLTZITE | XENOTIME. At least one of cve_id or actor is required.
- framework (string, optional) — filter to one framework. Valid values: nerc_cip, iec_62443_2_1, iec_62443_2_4, iec_62443_3_2, iec_62443_3_3, iec_62443_4_2, nist_800_82, nist_csf, cisa_cpg, nca_otcc, uae_nesa_ia. Omit or pass "all" for every framework.

---

### GET /ot/compliance/batch — Aggregate Compliance Gap Assessment  ($0.20 USDC)
Rolls up compliance-gap mapping across multiple CVEs/threat actors in a single call —
cheaper than N individual /ot/compliance calls when triaging a batch of new advisories
at once (e.g. 25 individual calls at $0.04 = $1.00 vs one batch call at $0.20).
Same compliance_mappings table as /ot/compliance — deterministic per-item lookup,
deduplicated and rolled up into one severity rating. DeepSeek only writes the
remediation summary prose.

**Query parameters:**
- items         (string, required) — comma-separated list of CVE IDs and/or actor names, max 25, e.g. CVE-2023-38802,CVE-2024-12345,SANDWORM,XENOTIME. Each token is auto-detected as a CVE ID (matches pattern CVE-YYYY-NNNNN) or treated as an actor name otherwise.
- framework     (string, optional) — same enum as /ot/compliance. Omit or pass "all" for every framework.
- entity_sector (string, optional) — ENERGY | WATER | TRANSPORTATION | GOVERNMENT. Informs the remediation summary's tone/priority framing only — does not filter which controls match.

**Response fields:**
- query_id                (string) — the CVE or actor queried
- frameworks              (object) — keyed by framework, each an array of triggered controls (control, title/requirement, status, action_required, compensating_control)
- controls_triggered      (number) — total controls triggered across all frameworks
- priority_action         (string) — single highest-priority recommended action
- data_sources[]          (array)

**Example call:**
GET https://ot-intel.daligence.com/ot/compliance?cve_id=CVE-2023-38802

**Example response:**
{
  "query_id": "CVE-2023-38802",
  "cve_id": "CVE-2023-38802",
  "frameworks": {
    "nerc_cip": [{
      "control": "CIP-007-6 R2",
      "title": "Security Patch Management",
      "status": "NON_COMPLIANT_IF_UNMITIGATED",
      "action_required": "Evaluate CVE-2023-38802 within 35 days of CISA KEV listing.",
      "compensating_control": "Network segmentation restricting BGP traffic to SCADA DMZ pending patch."
    }],
    "iec_62443_3_3": [{
      "component": "3-3 SR 5.1",
      "requirement": "Network Segmentation",
      "status": "NON_COMPLIANT_IF_UNMITIGATED",
      "compensating_control": "Enforce zone conduits: restrict BGP/ICS protocol traffic to whitelisted source/destination pairs."
    }]
  },
  "controls_triggered": 2,
  "priority_action": "Apply network segmentation at the ESP boundary immediately; schedule CVE patch for next maintenance window.",
  "data_sources": ["OT-Intel-DB-Compliance", "DeepSeek-CTI-Analysis"]
}

---

### GET /ot/threat-score — Actor-Target Threat Score (Capability x Opportunity x Intent)  ($0.04 USDC)
Deterministic capability x opportunity x intent threat score for an actor-target
pairing. Scored from actor/CVE/campaign data plus live GDELT geopolitical tension
and OFAC sanctions pressure signals. Not LLM-generated — the flagship risk
differentiator underlying /ot/risk-exposure and /ot/action-conformance.

**Query parameters:**
- actor        (string, required) — ICS threat actor name e.g. SANDWORM | VOLTZITE | XENOTIME
- sector       (string, required) — target sector e.g. energy | water | manufacturing
- region       (string, required) — target region or country e.g. Europe | GCC | Ukraine
- vendor_stack (string, required) — comma-separated OT/ICS vendors in the target environment e.g. Siemens,Schneider Electric. Pass "none" if unknown.

**Response fields:**
- capability / opportunity / intent (object each) — score (0-1), confidence, basis[]
- threat_score            (number)  — 0-100 composite score
- naive_product_score     (number)  — un-dampened product score for comparison
- exponents_applied       (object)  — per-leg exponent applied when confidence is none
- coverage                (number)  — 1 if no data gaps across the three legs
- confidence              (string)  — none | low | moderate | high
- actor_record_quality    (string)  — named_entity | generic_descriptor
- data_sources[]          (array)
- _methodology            (string)  — narrative on how the score was computed

**Example call:**
GET https://ot-intel.daligence.com/ot/threat-score?actor=SANDWORM&sector=energy&region=Europe&vendor_stack=Siemens,Schneider

**Example response:**
{
  "actor": "SANDWORM",
  "sector": "energy",
  "region": "Europe",
  "vendor_stack": ["Siemens", "Schneider Electric"],
  "capability": { "score": 0.82, "confidence": "moderate", "basis": ["physical_impact_tier:1", "ttps_mapped:14", "exploited_cves:3"] },
  "opportunity": { "score": 0.61, "confidence": "moderate", "basis": ["cves_on_record:9", "exploited_in_wild:2", "avg_cvss:8.1"] },
  "intent": { "score": 0.52, "confidence": "moderate", "basis": ["sector_history:direct", "campaign_geography:match", "geo_tension(Russia<->Europe):0.71", "sanctions_pressure(Russia):0.60"] },
  "threat_score": 26.0,
  "confidence": "moderate",
  "actor_record_quality": "named_entity",
  "data_sources": ["OT-Intel-DB", "GDELT Project (gdeltproject.org)", "OFAC Sanctions List (US Treasury)"]
}

---

### GET /ot/precursor-ttp — Precursor / Dwell-Time TTP Breakdown  ($0.04 USDC)
Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance
through command-and-control — the early-warning window before physical/process
disruption) vs impact-stage (inhibit-response-function, impair-process-control,
impact). Deterministic tactic-taxonomy lookup against intel.db — no LLM in the
classification path. Answers "how much dwell-time lead does this actor's
historical behavior typically afford before things go wrong" — the weak-signal
framing that precedes /ot/threat-score's post-hoc capability/opportunity/intent
scoring.

**Query parameters:**
- actor (string, required) — ICS threat actor name e.g. SANDWORM | VOLTZITE | XENOTIME

**Response fields:**
- total_ttps               (number)
- pre_impact / impact_stage / unclassified (object each) — count, ratio (0-1), techniques[]
- early_warning_assessment (string) — deterministic narrative summarising the split
- data_sources[]           (array)
- _methodology             (string)

**Example call:**
GET https://ot-intel.daligence.com/ot/precursor-ttp?actor=SANDWORM

**Example response:**
{
  "actor": "SANDWORM",
  "total_ttps": 14,
  "pre_impact": { "count": 9, "ratio": 0.64, "techniques": [{"technique_id": "T0846", "technique_name": "Remote System Discovery", "tactic": "discovery"}] },
  "impact_stage": { "count": 3, "ratio": 0.21, "techniques": [{"technique_id": "T0836", "technique_name": "Modify Parameter", "tactic": "impair_process_control"}] },
  "unclassified": { "count": 2, "ratio": 0.14, "techniques": [] },
  "early_warning_assessment": "9 of 14 known TTPs for SANDWORM are pre-impact stage (reconnaissance through command-and-control) — this actor typically presents an early-warning window before physical/process disruption, consistent with dwell-time behavior documented in ICS threat research.",
  "data_sources": ["OT-Intel-DB"],
  "_methodology": "Deterministic bucketing of ATT&CK-for-ICS tactics: pre_impact = initial_access, execution, persistence, privilege_escalation, evasion, discovery, lateral_movement, collection, command_and_control. impact_stage = inhibit_response_function, impair_process_control, impact. No LLM in the classification path."
}

---

### GET /ot/xai/root-cause-localization — Statistical Anomaly Attribution  ($0.15 USDC)
Given a set of sensor readings around a reported anomaly, ranks which sensors most
likely drove it by statistical deviation (z-score) from each sensor's own baseline.
Fully deterministic — no LLM, no db-intel.js lookup. Loosely inspired by the
attribution goal in Oswal et al. 2025 (kernel SHAP + temporal convolution
autoencoder, Int'l Journal of Advances in Applied Sciences) — this is a
statistical approximation of that goal, not a trained model. No SHAP values are
computed here; treat this as a fast, zero-infrastructure stand-in, not a
replacement for a real trained-model deployment.
If a sensor omits baseline_mean/baseline_stddev, this endpoint derives a baseline
from the first half of that sensor's own submitted window — with very few points
this can produce large-looking z-scores. The relative ranking across sensors is
still meaningful; the absolute z-score magnitude is not, absent a real historical
baseline.

**Query parameters:**
- window          (string, required) — URL-encoded JSON array, max 20 entries: [{ sensor_id, values: [...], baseline_mean?, baseline_stddev? }]. values needs at least 2 points; baseline_mean/baseline_stddev are optional per-sensor.
- top_k            (integer, optional, default 5) — how many ranked sensors to return
- anomaly_event_id (string, optional) — correlation ID, echoed back unchanged, does not affect computation

**Response fields:**
- sensors_evaluated       (number)
- root_cause_attribution[] — ranked by |z_score| descending: sensor_id, z_score, deviation_direction (ABOVE_BOUND | BELOW_BOUND | WITHIN_BOUND | FLATLINE), baseline_source (caller_supplied | computed_from_window)
- sensor_errors[]         (only present if any sensor entry was malformed)
- method                  (string) — "statistical_deviation_v1"
- data_sources[]          (array)

**Example call (window shown unencoded for readability):**
GET https://ot-intel.daligence.com/ot/xai/root-cause-localization?window=[{"sensor_id":"LIT_301","values":[3.1,3.0,3.2,3.1,8.9,9.1,9.0]},{"sensor_id":"MV_201","values":[0.5,0.5,0.5,0.5,0.5,0.5,0.5]}]&top_k=2

**Example response:**
{
  "anomaly_event_id": null,
  "sensors_evaluated": 2,
  "root_cause_attribution": [
    { "sensor_id": "LIT_301", "z_score": 72.26, "deviation_direction": "ABOVE_BOUND", "baseline_source": "computed_from_window" },
    { "sensor_id": "MV_201", "z_score": 0, "deviation_direction": "FLATLINE", "baseline_source": "computed_from_window" }
  ],
  "method": "statistical_deviation_v1",
  "data_sources": ["caller_supplied_telemetry"],
  "freshness": "2026-07-24T00:00:00.000Z"
}

---

### GET /ot/agentic/threat-hunt/control-loop — Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)  ($0.15 USDC)
Flags control-loop reconnaissance patterns (engineering-software/tag-browse activity)
and living-off-the-land or RMM-tool abuse from caller-submitted process/command
observations. Fully deterministic keyword/pattern matching — no LLM, no trained
model, no db-intel.js lookup. Grounded in CyberAgentX (multi-agent SOC threat-hunting
framework) and AgenticCyOps (Mitra et al., arXiv 2603.09134) for the threat model,
and Dragos's control-loop mapping concept for the recon indicator set.
ADVISORY ONLY: this endpoint never executes containment, isolation, or any action
against a caller's network. It returns text findings and canned recommendations
for a human SOC/OT operator to review — nothing here is auto-executable.

**Query parameters:**
- observed_processes (string, optional) — comma-separated process/tool names observed. At least one of observed_processes or observed_commands is required.
- observed_commands  (string, optional) — comma-separated command strings observed. Command strings must not contain literal commas.
- zone                (string, optional) — OT | IT | DMZ. Any RMM-tool or living-off-the-land match on an OT-zone asset is always scored HIGH, regardless of match count.

**Response fields:**
- matched_indicators[]      — category, indicator, matched_on (the submitted token that triggered it)
- categories_matched[]      — control_loop_recon | rmm_abuse | lotl
- risk_score                (number, 0-100) — weighted sum of matched indicators, x1.5 if zone is OT
- risk_level                (string) — CLEAN | LOW | MEDIUM | HIGH
- recommended_next_steps[]  — canned, per-category recommendations for a human operator; not LLM-generated prose
- advisory_only             (boolean, always true)
- data_sources[]

**Example call:**
GET https://ot-intel.daligence.com/ot/agentic/threat-hunt/control-loop?observed_processes=AnyDesk&zone=OT

**Example response:**
{
  "tokens_evaluated": 1,
  "zone": "OT",
  "matched_indicators": [{ "category": "rmm_abuse", "indicator": "anydesk", "matched_on": "AnyDesk" }],
  "categories_matched": ["rmm_abuse"],
  "risk_score": 53,
  "risk_level": "HIGH",
  "recommended_next_steps": [
    "Confirm the remote-access tool is on the approved vendor-support allowlist for this asset.",
    "Verify the session was initiated by an authorized account, not an unattended/service account."
  ],
  "advisory_only": true,
  "method": "keyword_pattern_match_v1",
  "data_sources": ["caller_supplied_telemetry"],
  "freshness": "2026-07-24T00:00:00.000Z"
}

---

### GET /ot/physics/invariant-reachability — Physical Invariant Check  ($0.20 USDC)
Checks whether a tank/vessel's reported level change is physically consistent with
its reported flow-in/flow-out over the same interval, via conservation of mass.
Fully deterministic arithmetic — no LLM, no db-intel.js lookup. Loosely inspired by
Barbhaya et al. 2025 (TEDA+CNN hybrid ICS detection framework, Computers & Chemical
Engineering) — implements only their underlying physical-invariant residual check,
not their trained detection model.
A residual mismatch is inherently ambiguous — it can indicate a sensor fault, a
physical leak, an unmetered inflow/outflow, or spoofed telemetry. This endpoint
flags the inconsistency and its direction; it does not assert a specific cause.

**Query parameters:**
- asset_id     (string, required) — identifier for the tank/vessel being checked
- flow_in      (number, required) — metered inflow rate (consistent units with tank_area/dt)
- flow_out     (number, required) — metered outflow rate
- level_start  (number, required) — level reading at the start of the interval
- level_end    (number, required) — level reading at the end of the interval
- dt_seconds   (number, required) — interval duration in seconds, must be > 0
- tank_area    (number, required) — cross-sectional area, must be > 0
- noise_floor  (number, optional, default 0.5) — residual magnitude below which the reading is treated as consistent (calibrate to your sensor noise floor)

**Response fields:**
- mass_balance_residual        (number) — expected volume change (from flows) minus measured volume change (from level)
- physical_invariant_violation (boolean)
- residual_direction           (string) — CONSISTENT | FLOW_EXCEEDS_MEASURED_LEVEL_CHANGE | LEVEL_CHANGE_EXCEEDS_FLOW
- suspicion_score              (number, 0-100) — bounded heuristic scaling of |residual| against noise_floor, NOT the paper's exact reachability-distance optimization
- possible_explanations[]      (array) — plausible causes for the given direction; not a diagnosis
- data_sources[]                (array)

**Example call:**
GET https://ot-intel.daligence.com/ot/physics/invariant-reachability?asset_id=TANK_302&flow_in=50&flow_out=40&level_start=100&level_end=120&dt_seconds=60&tank_area=10

**Example response:**
{
  "asset_id": "TANK_302",
  "mass_balance_residual": 400,
  "physical_invariant_violation": true,
  "residual_direction": "FLOW_EXCEEDS_MEASURED_LEVEL_CHANGE",
  "suspicion_score": 100,
  "possible_explanations": [
    "Level sensor under-reporting (fault or spoofing)",
    "Unmetered outflow — leak or diversion downstream of the flow meters",
    "Flow-in sensor over-reporting or flow-out sensor under-reporting"
  ],
  "method": "mass_balance_v1",
  "data_sources": ["caller_supplied_telemetry"],
  "freshness": "2026-07-24T00:00:00.000Z"
}

---

### GET /ot/vendor-risk — OT/ICS Third-Party Vendor Risk Assessment  ($0.15 USDC)
Supply-chain risk assessment for a specific OT/ICS vendor (e.g. Schneider Electric,
Siemens, Rockwell Automation, ABB, Honeywell). Aggregates CVE, campaign, and threat
actor mentions associated with the vendor from the OT Intel DB and synthesises a
risk tier, confidence level, and prescriptive supply-chain mitigation recommendations
via DeepSeek. ICD-203 estimative language throughout.
Certain restricted-license third-party sources are excluded from this analysis
due to commercial licensing restrictions.

**Query parameters:**
- vendor  (string, required) — OT/ICS vendor name e.g. Schneider Electric | Siemens | Rockwell Automation
- product (string, optional) — product line filter e.g. Modicon | SIMATIC

**Response fields:**
- vendor                          (string) — queried vendor name
- product                         (string|null) — product line filter, if given
- risk_tier                       (string) — low | moderate | elevated | high
- confidence                      (string) — low | moderate | high
- summary                         (string) — narrative risk summary
- cited_cves[]                    (array)  — CVE IDs found in the matched context
- targeting_actors[]              (array)  — threat actors named alongside vendor mentions, with rationale
- supply_chain_recommendations[]  (array)  — prescriptive mitigation steps
- tlp                             (string) — TLP:CLEAR

**Example call:**
GET https://ot-intel.daligence.com/ot/vendor-risk?vendor=Schneider+Electric&product=Modicon

**Example response:**
{
  "vendor": "Schneider Electric",
  "product": "Modicon",
  "risk_tier": "elevated",
  "confidence": "moderate",
  "summary": "Multiple actively exploited CVEs and one actor with historical targeting interest in Modicon PLC lines.",
  "cited_cves": ["CVE-2024-XXXXX"],
  "targeting_actors": [{"name": "CHERNOVITE", "rationale": "Historical targeting of Modicon PLC lines."}],
  "supply_chain_recommendations": ["Verify patch status of Modicon M580/M340 controllers against CVE-2024-XXXXX."],
  "tlp": "TLP:CLEAR"
}

---

### GET /ot/mitigation-map — D3FEND-Mapped Mitigation Guidance  ($0.20 USDC)
Prescriptive architecture mitigation guidance for OT/ICS threats. Maps MITRE ATT&CK
for ICS techniques to MITRE D3FEND defensive countermeasures. The technique-to-D3FEND
mapping is always deterministic — looked up from a hand-verified local crosswalk,
never generated by the model. DeepSeek is used only to (a) select the most relevant
technique ID when an actor or CVE is given instead of a technique ID directly, and
(b) write prescriptive recommendations from the already-resolved countermeasures.

**Query parameters (pass exactly one of):**
- actor        (string) — threat actor name e.g. SANDWORM
- cve_id       (string) — CVE identifier
- technique_id (string) — MITRE ATT&CK ICS technique ID e.g. T0836
- vendor_stack (string, optional) — vendor/product context e.g. "Schneider Modicon"

**Response fields:**
- actor / cve_id / technique_id / vendor_stack (echo of query)
- confidence                     (string) — low | moderate | high
- summary                        (string) — narrative summary
- mitigations[]                  (array)  — matched technique(s), each with:
  - attack_technique_id          (string) — e.g. T0836
  - attack_technique_name        (string) — e.g. "Modify Parameter"
  - d3fend_countermeasures[]     (array)  — {id, name, priority, rationale}
- architecture_recommendations[] (array)  — prescriptive next steps
- technique_selection            (object|null) — present only when actor/cve_id was used instead of technique_id; shows confidence + rationale for the selected technique
- tlp                            (string) — TLP:CLEAR

**Example call:**
GET https://ot-intel.daligence.com/ot/mitigation-map?actor=SANDWORM&vendor_stack=Schneider+Modicon

**Example response:**
{
  "actor": "SANDWORM",
  "cve_id": null,
  "technique_id": null,
  "vendor_stack": "Schneider Modicon",
  "confidence": "moderate",
  "summary": "SANDWORM has historically used parameter modification techniques against ICS controllers.",
  "mitigations": [
    {
      "attack_technique_id": "T0836",
      "attack_technique_name": "Modify Parameter",
      "d3fend_countermeasures": [
        {"id": "D3-PSMD", "name": "Process Segment Monitoring / Deviation Detection", "priority": "high", "rationale": "Detects unauthorized setpoint changes."}
      ]
    }
  ],
  "architecture_recommendations": ["Deploy baseline deviation monitoring on Modicon controller parameter writes."],
  "technique_selection": {"confidence": "moderate", "rationale": "SANDWORM's known TTPs against ICS controllers most closely match parameter modification."},
  "tlp": "TLP:CLEAR"
}

---

### GET /ot/risk-exposure — Board/GRC-Level Portfolio Risk Aggregator  ($0.40 USDC)
Aggregates the same deterministic capability x opportunity x intent scoring used by
/ot/threat-score across the actors relevant to a sector, ranks them, and has DeepSeek
write a board-level executive summary (BLUF structure, ICD-203 language) over the
aggregate. For vCISO agents, board-reporting pipelines, and GRC automation feeding
executive dashboards — /ot/threat-score answers "how risky is this one actor", this
answers "what's our overall exposure right now".

**Query parameters:**
- sector                (string, required) — e.g. energy, water, manufacturing
- region                (string, required) — e.g. GCC, KSA, UAE, Qatar, Europe
- compliance_framework  (string, optional) — noted qualitatively in the narrative
- timeframe             (string, optional) — default 90d
- vendor_stack          (string, optional) — comma-separated, e.g. "Schneider Modicon,Siemens SIMATIC" — feeds the capability leg of each actor's score, same as /ot/threat-score

**Example call:**
GET https://ot-intel.daligence.com/ot/risk-exposure?sector=energy&region=GCC

**Example response:**
{
  "sector": "energy",
  "region": "GCC",
  "compliance_framework": null,
  "timeframe": "90d",
  "executive_summary": {
    "bluf": "GCC energy sector faces elevated risk from state-linked ICS-targeting actors.",
    "narrative": "Threat activity against regional energy infrastructure has likely increased..."
  },
  "portfolio_risk_level": "ELEVATED",
  "confidence": "moderate",
  "top_threats": [
    {"actor": "ELECTRUM", "threat_score": 26.0, "confidence": "moderate"}
  ],
  "data_sources": ["OT-Intel-DB", "GDELT Project (gdeltproject.org)", "OFAC Sanctions List (US Treasury)", "DeepSeek-CTI-Synthesis"]
}

---

### GET /ot/action-conformance — Remediation Risk Gate  ($0.12 USDC)
An agent posts a planned remediation action (block an IP, quarantine a host, halt
a pipeline...) against an actor/sector/region context and gets back a deterministic
auto_approve / human_review / reject verdict. No DeepSeek in the decision path —
this is a governance gate, not a narrative, so the verdict has to be reproducible.
Built on the same capability x opportunity x intent scoring as /ot/threat-score,
with simple auditable rules layered on top (shared cloud/CDN infrastructure in
asset_context → escalate; bottom-quartile score → reject; top-decile score →
auto-approve; everything else → human review — thresholds calibrated from real
score percentiles, not confidence, since confidence output carries no
discriminating signal in current data).

**Query parameters:**
- actor           (string, required) — e.g. SANDWORM
- sector          (string, required) — e.g. energy, water
- region          (string, required) — e.g. GCC, Europe
- planned_action  (string, required) — one of: block_ip, block_domain, quarantine_host, isolate_segment, halt_pipeline, disable_account
- asset_context   (string, optional) — free text, e.g. "shared_infra:cloudflare"
- vendor_stack    (string, optional) — comma-separated, e.g. "Schneider Modicon,Siemens SIMATIC" — feeds the capability leg of the underlying score, same as /ot/threat-score

**Example call:**
GET https://ot-intel.daligence.com/ot/action-conformance?actor=SANDWORM&sector=energy&region=Europe&planned_action=block_ip

**Example response:**
{
  "actor": "SANDWORM",
  "sector": "energy",
  "region": "Europe",
  "planned_action": "block_ip",
  "asset_context": null,
  "risk_tier": "auto_approve",
  "rationale": "Threat score (29.3) is in the top decile of observed scores — supports automated execution.",
  "supporting_evidence": {"threat_score": 29.3, "confidence": "low", "shared_infra_detected": false},
  "data_sources": ["OT-Intel-DB", "GDELT Project (gdeltproject.org)", "OFAC Sanctions List (US Treasury)"]
}

---

### GET /ot/ai-exposure — AI/Agentic Copilot Attack Surface Lookup  ($0.20 USDC)
Given a vendor, returns whether they have a publicly documented AI/agentic copilot
in their OT/ICS product line, its autonomy level (advisory vs agentic — the primary
risk differentiator, same principle as /ot/action-conformance), what it can access,
and the MITRE ATLAS techniques that apply given that access level. Deterministic
lookup against a hand-verified mapping — no DeepSeek in the path. ATLAS technique
IDs were confirmed directly against the live atlas.mitre.org matrix, not secondary
summaries, so citations are traceable to the primary source.

**Query parameters:**
- vendor (string, required) — e.g. Siemens, Schneider Electric, Rockwell Automation, ABB, Emerson, Honeywell, Yokogawa, GE Vernova, Omron, Mitsubishi Electric

**Example call:**
GET https://ot-intel.daligence.com/ot/ai-exposure?vendor=Honeywell

**Example response:**
{
  "vendor": "Honeywell",
  "product": "Experion Cognition (AI-enabled control system platform)",
  "exposure_level": "agentic",
  "deployment_status": "Live proof-of-concept at Borouge International's Ruwais facility (Abu Dhabi); commercial availability not yet general.",
  "access": "Honeywell Experion Process Knowledge System (DCS); continuous operational data across the facility. Explicitly makes 'recommendations and automated decisions' to resolve anomalies.",
  "atlas_mappings": [
    {"technique_id": "AML.T0051", "technique_name": "LLM Prompt Injection", "shared_risk": true},
    {"technique_id": "AML.T0053", "technique_name": "AI Agent Tool Invocation", "shared_risk": false, "rationale": "Agents hold automated decision-making authority in the control loop."},
    {"technique_id": "AML.T0110", "technique_name": "AI Agent Tool Poisoning", "shared_risk": false, "rationale": "Ongoing autonomous operation makes persistence via poisoned tool definitions materially higher-consequence."}
  ],
  "source": "Honeywell press release; corroborated by ARC Advisory Group, Control Engineering, and 6+ other independent trade outlets",
  "confidence": "moderate — proof-of-concept, not yet generally available",
  "data_sources": ["MITRE ATLAS (atlas.mitre.org)", "Vendor public disclosures"]
}

---

### GET /ot/ai-uplift — Attacker AI-Uplift Exposure  ($0.20 USDC)
Given a vendor (and optionally deployment context), assesses how much a
general-purpose AI agent (Claude, GPT — not a specialized ICS tool) lowers
the skill/time barrier for an attacker to find and reach that vendor's
OT-adjacent footprint. Grounded in a real-world precedent — Dragos's May
2026 "AI in the Breach" report on a Mexican water utility intrusion, where
Claude independently recognized an OT-adjacent gateway as a target and
researched vendor documentation to build a credential list, without any
prior ICS-specific context. The finding: current AI models add no novel
ICS-specific capability, but compress the time between an IT compromise
and a credible attempt on OT.

**Distinct from /ot/ai-exposure** (which looks up whether a vendor's OWN
product embeds an AI copilot). This endpoint is about attackers USING AI
as a tool against a vendor's ordinary, non-AI OT gear.

DeepSeek-synthesised over this org's own CTI corpus (CVE/actor/campaign
context + compliance compensating-control hints + any known real-world
AI-assisted-targeting precedents) plus caller-declared deployment facts.
This API has no asset inventory — deployment context is caller-declared,
not inferred. If internet_facing, auth_type, and segmented are all left
"unknown" (the default), the exposure tier is deterministically capped at
"informational" rather than left to model speculation.

**Query parameters:**
- vendor (string, required) — e.g. Schneider Electric, Siemens, Rockwell Automation
- product (string, optional) — e.g. Modicon
- internet_facing (string, optional) — true, false, or unknown (default)
- auth_type (string, optional) — single-factor, mfa, or unknown (default)
- segmented (string, optional) — true, false, or unknown (default)

**Example call:**
GET https://ot-intel.daligence.com/ot/ai-uplift?vendor=Schneider+Electric&product=Modicon&internet_facing=true&auth_type=single-factor&segmented=false

**Example response:**
{
  "vendor": "Schneider Electric",
  "product": "Modicon",
  "ai_exposure_tier": "moderate",
  "confidence": "moderate",
  "summary": "Modicon PLC line has documented CVEs with public exploit context and no MFA on the management interface; no direct AI-assisted-targeting precedent yet found in the corpus for this vendor.",
  "known_precedents": [],
  "compensating_controls": ["Restrict engineering workstation access via allowlisting", "Segment Modicon management VLAN from general IT"],
  "recommendations": ["Enforce MFA on all remote engineering access", "Monitor for password-spray patterns against gateway interfaces"],
  "deployment_context_used": {"internet_facing": "true", "auth_type": "single-factor", "segmented_from_it": "false"},
  "tlp": "TLP:CLEAR"
}

---

### GET /ot/ai-attack-feasibility — LLM-Generated ICS Attack Feasibility  ($0.20 USDC)
Deterministic lookup against ONE specific empirical study — Cook, Stoica,
Shah & Pezaros, "With Power comes Responsibility: Attack Synthesis for
Industrial Control Systems using Large Language Models" (ACM Trans. Priv.
Sec. 29, 3, Article 31, June 2026) — that tested whether five off-the-shelf
general-purpose LLMs (GPT-4o, Gemini 2.0 Flash, DeepSeek-V3, Qwen 2.5 72B,
LLaMA 3.3 70B) could generate WORKING attack code against three real PLC
models (Siemens S7-1200, Rockwell Micro850, Schneider Modicon M221) on a
physical testbed.

**Scope honesty — this is narrow evidence, not a general AI-risk claim:**
only these 3 vendors were tested (absence of a vendor is not evidence of
safety); only Network and Register/Tags-layer techniques ever succeeded —
zero success on Application Code or Firmware manipulation across all 5 LLMs
and all 3 PLCs; overall end-to-end success rate across the whole study was
1.08% (15 of 1,395 generated scripts). Claude models (3 Opus, 3.5 Haiku,
3.5 Sonnet) were excluded by the paper's own authors specifically because
Claude's safety measures were "much harder to bypass" than the other five
models' guardrails — the paper's own stated finding, most relevant data
point in this endpoint for a Claude-consuming caller.

**Distinct from /ot/ai-exposure** (vendor's OWN embedded AI copilot attack
surface) **and /ot/ai-uplift** (open-ended DeepSeek-synthesised
reconnaissance-uplift assessment). This endpoint answers one narrow,
testable question: did off-the-shelf LLMs demonstrably generate working
attack code for this specific technique/vendor/campaign in this study?

**Query parameters (pass at least one):**
- technique (string, optional) — MITRE ICS technique name or ID, e.g. "Brute Force I/O" or T0806
- vendor (string, optional) — Siemens, Schneider Electric, or Rockwell Automation (only these three were tested)
- campaign (string, optional) — Industroyer2, Fuxnet, FrostyGoop, INCONTROLLER, Stuxnet, or Triton

**Example call:**
GET https://ot-intel.daligence.com/ot/ai-attack-feasibility?technique=Brute+Force+I/O

**Example response:**
{
  "query": {"technique": "Brute Force I/O", "vendor": null, "campaign": null},
  "technique_result": {
    "status": "llm_achievable",
    "technique_name": "Brute Force I/O",
    "technique_id": "T0806",
    "id_status": "confirmed_current_matrix",
    "category": "Register and Tags",
    "min_context_level": "High",
    "cvss_3_1": 5.7,
    "cia_impact": {"confidentiality": false, "integrity": true, "availability": true}
  },
  "source": "Cook, Stoica, Shah & Pezaros, ACM Trans. Priv. Sec. 29, 3, Article 31 (June 2026), DOI: 10.1145/3815116"
}

---

### GET /ot/claim-reliability — CTI Claim Reliability Scoring  ($0.20 USDC)
Grounded in Meng et al., "Uncovering Vulnerabilities of LLM-Assisted Cyber
Threat Intelligence" (arXiv:2509.23573v3, Feb 2026). The paper's core finding:
the dominant reliability bottleneck in LLM-assisted CTI isn't generic
hallucination — it's that CTI itself is a fragmented, volatile, crowdsourced
ecosystem spanning structured databases, semi-structured vendor advisories,
and unstructured social/forum discussion. It identifies three
domain-specific failure modes:
- **spurious_correlation** — claim rests on co-mention bias, reused-IoC
  exploitation bias, or confounding factors rather than a demonstrated
  causal/attributional link
- **contradictory_knowledge** — claim conflicts with more recent evidence,
  conflicting attack-context reports, or diverges from how other sources
  structure the same event
- **constrained_generalization** — claim concerns an emerging
  actor/technique/campaign combination outside well-established public
  reporting, so any assessment is extrapolation rather than a grounded fact

This endpoint operationalises that taxonomy as a standalone confidence
layer: pass a CTI claim, optionally with an actor or CVE for grounding, and
get back a verdict, reliability score, and which of the three failure modes
apply — the "how much should I trust this" signal that /ot/threat-score,
/ot/dossier, and /ot/report don't otherwise expose. If no grounding text is
found in intel.db, the endpoint always flags constrained_generalization
and caps confidence at "low" — deterministic, not left to the model to
decide it has grounding it doesn't.

**Query parameters:**
- claim (string, required) — the CTI claim to assess
- actor (string, optional) — actor name to ground against intel.db, e.g. SANDWORM
- cve_id (string, optional) — CVE ID to ground against intel.db

**Example call:**
GET https://ot-intel.daligence.com/ot/claim-reliability?claim=SANDWORM+has+expanded+targeting+to+water-sector+Modbus+deployments+in+the+Gulf+region&actor=SANDWORM

**Example response:**
{
  "claim": "SANDWORM has expanded targeting to water-sector Modbus deployments in the Gulf region",
  "actor": "SANDWORM",
  "verdict": "unverifiable",
  "reliability_score": 0.35,
  "failure_mode_flags": ["constrained_generalization"],
  "reasoning": "No intel.db records corroborate a Gulf-region water-sector shift for SANDWORM; existing reporting concentrates on Ukraine/Europe energy targeting.",
  "corroborating_evidence": [],
  "contradicting_evidence": ["intel.db campaign records show SANDWORM activity concentrated in European energy/grid targets, not Gulf water utilities"],
  "confidence": "low",
  "grounded_in_db": true,
  "tlp": "TLP:CLEAR",
  "source": "Meng et al., arXiv:2509.23573v3 (Feb 2026)"
}

---

### GET /ot/stix-coverage — STIX Representability + Actionability Lookup  ($0.20 USDC)
Deterministic lookup grounded in Hahn, Krief, Rebori-Carretero, Puzis,
Elyashar & Urlaub, "An Evidence-Driven Analysis of Threat Information
Sharing Challenges for Industrial Control Systems and Future Directions"
(arXiv:2512.18714v3, Jan 2026). The paper systematically scored 361 threat
observables across 196 ATT&CK-for-ICS procedure examples (79 techniques, 22
malware families) plus 9 CISA KEV advisories against two axes: whether STIX
2.1 has an object that can represent the artifact at all, and whether
public reporting gave enough detail to actually build a detection from it.
Headline finding: 53% of observables have only partial STIX support, 19%
have none at all, and 77% lack sufficient technical detail to be
actionable — including some flagged "actionable" that STIX still can't
represent.

This endpoint answers what STIX sharing alone can't tell you: if you
receive or share this technique via STIX today, can the recipient actually
act on it, or does it fall in a documented gap? No LLM in the lookup path —
this is a direct lookup against the paper's own per-technique tables
(Triton/Stuxnet/Industroyer case studies), protocol parser-availability
table, and CISA KEV table.

**Scope honesty:** this dataset covers only the techniques/protocols/CVEs
the paper tabulated in its three published case studies and CISA KEV
table — not the full 361-observable systematic corpus (never published as
a per-row table). Absence from this dataset isn't evidence of good STIX
coverage; it means the paper didn't score that specific instance in a
table.

**Query parameters (pass at least one of technique_id, protocol, cve_id):**
- technique_id (string, optional) — MITRE ATT&CK ICS ID, e.g. T0836
- campaign (string, optional) — filter to Triton, Stuxnet, or Industroyer
- protocol (string, optional) — e.g. TriStation, S7Comm, IEC 61850 MMS, CIP
- cve_id (string, optional) — from the paper's CISA KEV table, e.g. CVE-2023-3595

**Example call:**
GET https://ot-intel.daligence.com/ot/stix-coverage?technique_id=T0836&campaign=Stuxnet

**Example response:**
{
  "query": {"technique_id": "T0836", "campaign": "Stuxnet", "protocol": null, "cve_id": null},
  "technique_result": {
    "matches": [{"technique_id": "T0836", "campaign": "Stuxnet", "artifact": "Profibus messages to frequency-converter drives", "stix_support": "partial", "stix_object": "NetworkTraffic:src/dst_payload_ref", "artifact_detail": "described", "proprietary": "open_standard", "parser_available": "no"}],
    "cross_campaign_variance": false
  },
  "corpus_stats": {"total_observables_scored": 361, "full_stix_support": 101, "partial_stix_support": 191, "no_stix_support": 69, "actionable": 87, "not_actionable": 274},
  "source": "Hahn, Krief, Rebori-Carretero, Puzis, Elyashar & Urlaub, arXiv:2512.18714v3 (Jan 2026)"
}

---

### GET /ot/analyst-brief — Analyst Brief  ($0.12 USDC)
Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment
for a threat actor (optionally scoped to a sector). Same fan-out data as /ot/report
(actor, campaign, malware, advisory) but DeepSeek-synthesised into a short
decision-ready brief instead of a full report.

**Query parameters:**
- actor  (string, required) — ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME
- sector (string, optional) — target sector e.g. energy, water, manufacturing

**Example call:**
GET https://ot-intel.daligence.com/ot/analyst-brief?actor=SANDWORM&sector=energy

**Example response:**
{
  "actor": "SANDWORM", "sector": "energy",
  "bluf": "SANDWORM assessed capable, moderate confidence, of impacting energy-sector Siemens deployments based on current campaign activity.",
  "key_judgments": ["Historical direct targeting of energy sector", "Active exploitation of 2 CVEs in current advisory window", "Documented ICS-specific malware in use"],
  "confidence": "moderate",
  "recommended_next_step": "Cross-check /ot/threat-score for a numeric score with your specific vendor stack.",
  "tlp": "TLP:CLEAR"
}

---

### GET /ot/vendor-risk-delta — Vendor-Swap Risk Comparison  ($0.20 USDC)
Counterfactual vendor-swap risk comparison. Runs the same DeepSeek assessment used
by /ot/vendor-risk on each vendor and returns the risk-tier delta plus per-vendor
summaries — for pre-purchase or migration decisions.

**Query parameters:**
- vendor_current   (string, required) — current OT/ICS vendor name e.g. Siemens
- vendor_proposed  (string, required) — proposed replacement vendor name e.g. Schneider Electric
- product_current  (string, optional) — current product line e.g. SIMATIC
- product_proposed (string, optional) — proposed product line e.g. Modicon

**Example call:**
GET https://ot-intel.daligence.com/ot/vendor-risk-delta?vendor_current=Siemens&vendor_proposed=Schneider+Electric

**Example response:**
{
  "vendor_current": "Siemens", "vendor_proposed": "Schneider Electric",
  "current_risk_tier": "elevated", "proposed_risk_tier": "moderate",
  "tier_delta": -1, "direction": "better",
  "current_summary": "Multiple actively exploited CVEs.",
  "proposed_summary": "No actively exploited CVEs on record.",
  "current_cited_cves": ["CVE-2024-0001"], "proposed_cited_cves": [],
  "model_written": true,
  "tlp": "TLP:CLEAR"
}

---

### GET /ot/sighting/submit — Submit OT Sighting  ($0.05 USDC)
Submit an anonymized IOC/TTP sighting observed in your own OT environment. Feeds
the correlation corpus without storing an org identifier. Written to a separate
sightings store, not intel.db.

**Query parameters:**
- ioc_or_ttp_id (string, required) — CVE ID, MITRE ATT&CK-for-ICS technique ID, or sha256 hash
- sector        (string, required) — sector where this was observed e.g. energy, water
- region        (string, required) — region where this was observed e.g. KSA, UAE
- actor_name    (string, optional) — actor name if the sighting is attributed
- observed_at   (string, optional) — ISO 8601 timestamp of observation

**Example call:**
GET https://ot-intel.daligence.com/ot/sighting/submit?ioc_or_ttp_id=CVE-2024-12345&sector=energy&region=KSA

**Example response:**
{ "accepted": true, "ioc_id": "CVE-2024-12345", "_note": "Recorded — not yet correlated into intel.db scoring." }

---

### GET /ot/gcc-bulletin — GCC OT Threat Sitrep  ($0.01 USDC)
Recurring public "State of OT Threat Intel — GCC" sitrep, human-reviewed before
publish, sourced from the same intel.db pipeline as /ot/sitrep.

**Query parameters:**
- issue_date (string, optional) — YYYY-MM-DD of a past edition; defaults to latest reviewed edition

**Example call:**
GET https://ot-intel.daligence.com/ot/gcc-bulletin

**Example response:**
{
  "issue_date": "2026-07-20", "region": "GCC",
  "summary": "Elevated OT threat activity across UAE energy sector this period.",
  "full_text": "...",
  "tlp": "TLP:CLEAR"
}

---

## Pricing Summary
| Endpoint          | Price   | Best for                                        |
|-------------------|---------|-------------------------------------------------|
| /ot/ioc           | $0.01   | High-volume IOC triage, SOC blocklist pipelines |
| /ot/gcc-bulletin  | $0.01   | Recurring public GCC OT threat sitrep           |
| /ot/cve           | $0.02   | CVE prioritisation, ICS-CERT workflows          |
| /ot/advisory      | $0.02   | Vendor/sector advisory monitoring               |
| /ot/malware       | $0.02   | ICS malware lookup — PIPEDREAM, TRITON, INDUSTROYER2 |
| /ot/actor         | $0.03   | Threat actor profiling, sector briefings        |
| /ot/actor/sector  | $0.03   | Sector-level threat landscape                   |
| /ot/delta         | $0.03   | Change feed — only what's new since last call   |
| /ot/asn           | $0.03   | ICS threat actor ASN infrastructure profiling   |
| /ot/compliance    | $0.04   | Multi-framework compliance gap mapping (11 frameworks) |
| /ot/threat-score  | $0.04   | Deterministic capability x opportunity x intent score  |
| /ot/precursor-ttp | $0.04   | Pre-impact vs impact-stage TTP breakdown (dwell-time/early-warning) |
| /ot/detection     | $0.05   | YARA/Sigma detection artifacts for ICS malware/actors |
| /ot/patch         | $0.05   | Patch feasibility, NERC CIP compliance          |
| /ot/device        | $0.05   | Device CVEs, advisories, hardening profile      |
| /ot/exposure      | $0.05   | Asset risk verdict — escalate true/false        |
| /ot/campaign      | $0.05   | Active campaigns targeting a sector right now   |
| /ot/sighting/submit | $0.05 | Submit anonymized IOC/TTP sighting from your OT environment |
| /ot/brief         | $0.10   | Complete 30d sector threat brief, risk trend    |
| /ot/xpost         | $0.10   | X/Twitter thread (5-7 posts) for actor or CVE  |
| /ot/action-conformance | $0.12 | Deterministic remediation action risk gate     |
| /ot/analyst-brief | $0.12   | BLUF-style decision-ready actor brief           |
| /ot/linkedin      | $0.15   | LinkedIn post for CTI/ICS security audience     |
| /ot/vendor-risk   | $0.15   | OT/ICS third-party (supply-chain) vendor risk   |
| /ot/xai/root-cause-localization | $0.15 | Statistical per-sensor anomaly attribution, caller-supplied telemetry window (Oswal et al. 2025-inspired) |
| /ot/agentic/threat-hunt/control-loop | $0.15 | Advisory-only keyword-pattern threat hunt for control-loop recon and RMM/LOTL abuse |
| /ot/physics/invariant-reachability | $0.20 | Deterministic mass-balance physical-invariant check for tank/flow telemetry (Barbhaya et al. 2025-inspired) |
| /ot/compliance/batch | $0.20 | Aggregate compliance-gap assessment across multiple CVEs/actors |
| /ot/ai-exposure   | $0.20   | AI/agentic copilot attack surface lookup (MITRE ATLAS) |
| /ot/ai-uplift     | $0.20   | Attacker-AI-uplift exposure (Dragos-precedent-grounded)  |
| /ot/ai-attack-feasibility | $0.20 | LLM-generated ICS attack feasibility (Cook et al. 2026) |
| /ot/claim-reliability | $0.20 | CTI claim reliability scoring (Meng et al. 2026)        |
| /ot/stix-coverage | $0.20   | STIX representability + actionability lookup (Hahn/Krief et al. 2026) |
| /ot/mitigation-map| $0.20   | D3FEND-mapped mitigation guidance (actor/CVE/technique) |
| /ot/vendor-risk-delta | $0.20 | Counterfactual vendor-swap risk comparison    |
| /ot/risk-exposure | $0.40   | Board/GRC portfolio risk aggregator (sector+region)|
| /ot/report        | $0.25   | Full actor threat report in Markdown            |
| /ot/dossier       | $0.35   | Deep actor dossier — IOCs, infra, detections    |
| /ot/sitrep        | $0.35   | Sector situation report — 30-day picture        |
| /ot/article       | $0.45   | Publication-ready CTI article (~700 words)      |

## Composed Endpoints (Synthesis Tier)
The following endpoints fan out to multiple primitives internally (no extra charge)
and synthesise a finished artifact via DeepSeek. One call replaces 4-6 chained calls.

### GET /ot/report — Threat Actor Report  ($0.25 USDC)
Full Markdown threat report for an ICS/APT actor. Internally calls /ot/actor,
/ot/campaign, /ot/malware, /ot/advisory, and /ot/detection. DeepSeek synthesises
into a structured report: executive summary, actor profile, active campaigns,
malware families, sector targeting, recommended actions. TLP: WHITE.

**Query parameters:**
- actor  (string, required) — actor name e.g. CHERNOVITE | SANDWORM | VOLTZITE
- sector (string, optional) — focus on a specific sector e.g. energy | water

**Example call:**
GET https://ot-intel.daligence.com/ot/report?actor=CHERNOVITE&sector=energy

---

### GET /ot/dossier — Deep Actor Dossier  ($0.35 USDC)
Deep intelligence dossier for an actor. Internally calls /ot/actor, /ot/campaign,
/ot/malware, /ot/ioc, /ot/asn, and /ot/detection. Returns full profile plus
infrastructure analysis, IOC table, detection rules section, and kill chain mapping.

**Query parameters:**
- actor  (string, required) — actor name e.g. SANDWORM | XENOTIME | VOLTZITE

**Example call:**
GET https://ot-intel.daligence.com/ot/dossier?actor=SANDWORM

---

### GET /ot/sitrep — Sector Situation Report  ($0.35 USDC)
30-day situation report for an industrial sector. Internally calls /ot/actor/sector,
/ot/advisory, /ot/campaign, /ot/delta, /ot/exposure (sample), and /ot/compliance.
Returns threat landscape, top actors, new advisories, what changed, compliance posture,
and recommended priorities. Designed for weekly security briefing automation.

**Query parameters:**
- sector  (string, required) — energy | water | manufacturing | oil-and-gas | electric | nuclear | chemical
- period  (number, optional) — lookback days, default 30

**Example call:**
GET https://ot-intel.daligence.com/ot/sitrep?sector=energy&period=30

---

### GET /ot/article — CTI Article  ($0.45 USDC)
Publication-ready threat intelligence article (~700 words). Internally calls /ot/actor,
/ot/campaign, /ot/malware, and /ot/advisory. DeepSeek writes in journalistic CTI style:
headline, lede, body with MITRE ATT&CK technique context, defanged IOC section,
analyst assessment, and TLP marking. Suitable for threat intel blog posts or advisories.

**Query parameters:**
- actor   (string, required if no cve) — actor name e.g. CHERNOVITE
- cve     (string, required if no actor) — CVE ID e.g. CVE-2024-12345
- sector  (string, optional) — sector context e.g. energy

**Example call:**
GET https://ot-intel.daligence.com/ot/article?actor=CHERNOVITE&sector=energy

---

### GET /ot/linkedin — LinkedIn Post  ($0.15 USDC)
LinkedIn post optimised for CTI/ICS security audience. Internally calls /ot/actor
or /ot/cve + /ot/advisory. DeepSeek writes: hook line, 3-5 bullet intelligence
observations, call to action, and relevant hashtags. Ready to publish.

**Query parameters:**
- actor  (string, required if no cve) — actor name e.g. VOLTZITE
- cve    (string, required if no actor) — CVE ID e.g. CVE-2024-12345

**Example call:**
GET https://ot-intel.daligence.com/ot/linkedin?actor=VOLTZITE

---

### GET /ot/xpost — X/Twitter Thread  ($0.10 USDC)
X/Twitter thread (5-7 posts) on an actor or CVE. Internally calls /ot/actor or
/ot/cve. DeepSeek writes: hook post, 3-4 intel posts with ATT&CK technique IDs
and affected systems, mitigation post, and hashtag post. Each post under 280 chars.

**Query parameters:**
- actor  (string, required if no cve) — actor name e.g. XENOTIME
- cve    (string, required if no actor) — CVE ID e.g. CVE-2024-12345

**Example call:**
GET https://ot-intel.daligence.com/ot/xpost?actor=XENOTIME

---

## Payment
All endpoints return HTTP 402 if unpaid. Use any x402-compatible client:

  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/cve" -q '{"id": "CVE-2023-38802"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/actor" -q '{"name": "VOLTZITE"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/ioc" -q '{"value": "185.220.101.45", "type": "ip"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/advisory" -q '{"vendor": "siemens"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/device" -q '{"vendor": "unitronics", "model": "vision"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/patch" -q '{"id": "CVE-2021-34527"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/actor/sector" -q '{"sector": "energy"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/exposure" -q '{"vendor": "siemens", "model": "s7-1500", "sector": "energy", "network": "internet-facing"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/campaign" -q '{"sector": "electric", "status": "active"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/delta" -q '{"sector": "water", "days": "7"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/malware" -q '{"name": "PIPEDREAM"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/brief" -q '{"sector": "energy", "period": "30"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/asn" -q '{"asn": "AS215540"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/detection" -q '{"target": "PIPEDREAM", "format": "yara"}'
  npx awal@latest x402 pay "https://ot-intel.daligence.com/ot/compliance" -q '{"cve_id": "CVE-2023-38802"}'

## MCP (Model Context Protocol)
Endpoint: https://ot-intel.daligence.com/mcp  (Streamable HTTP, protocol 2026-07-28; 2025-03-26..2025-11-25 clients also accepted)
Server card: https://ot-intel.daligence.com/mcp/server-card
Every paid endpoint above is exposed as an MCP tool (tool name = OpenAPI operationId, e.g. getCveTriage), same price.
Payment uses the x402 MCP transport: an unpaid tools/call returns isError:true with an x402 PaymentRequired object
(structuredContent + content[0].text). Sign it with any x402 client and retry the identical call with the payload in
params._meta["x402/payment"]. The settlement receipt is returned in result._meta["x402/payment-response"].

## Response signing
Every paid JSON response (2xx object bodies) carries a _provenance block:
{ scheme, signer, digest, signature, signed_at, verify }. Scheme: ot-intel-sig/1 (RFC8785-JCS + SHA-256 + EIP-191),
the same scheme as TeleSINT. The signer address is published free at /.well-known/ot-intel-signer.json: pin it.
The signing key is dedicated and is NOT the payment wallet.
Verify: remove _provenance, canonicalise the rest with RFC 8785 (JCS), digest = "0x" + hex(sha256(canonical))
must equal _provenance.digest, then viem.verifyMessage({ address: signer, message: digest, signature }) must be true.
A valid signature proves origin and integrity, not that the intelligence is true. 402s and free routes are unsigned.

## Discovery
x402 manifest: https://ot-intel.daligence.com/.well-known/x402.json
Agent card:    https://ot-intel.daligence.com/.well-known/agent-card.json
OpenAPI:       https://ot-intel.daligence.com/openapi.json