Directory / ot-intel-api.onrender.com
ICS sector change feed — only what is NEW in the last N days. Pass ?sector=water&days=7. Returns new CVEs, new CISA advisories, and new actor activity since the last call. Designed for cron-based monitoring agents. Eliminates redundant reprocessing.
# 1. Ask the endpoint what it costs (no payment, no wallet needed): curl -i -X GET 'https://ot-intel-api.onrender.com/ot/delta' # -> HTTP/1.1 402 Payment Required # the response carries the price, asset and pay-to address. # 2. Pay and retry with any x402 client: npx x402-fetch 'https://ot-intel-api.onrender.com/ot/delta'
Endpoint: https://ot-intel-api.onrender.com/ot/delta. Operated by ot-intel-api.onrender.com, not by Animica. Price and availability were correct at the last probe on 2026-09-02 and are set by the operator, who may change them.
Deterministic remediation risk gate. Pass actor, sector, region, planned_action (e.g. block_ip, halt_pipeline, disable_account). Returns auto_approve/human_revi…
ICS threat actor profile. Pass ?name=SANDWORM. Returns MITRE ATT&CK ICS techniques, known malware, attribution, physical impact, targeted sectors, and OT detect…
ICS threat actors by sector. Pass ?sector=energy. Returns all groups targeting that sector from live MITRE ATT&CK ICS STIX data. Covers energy, water, manufactu…
Live CISA ICS-CERT advisories filtered by vendor or sector. Pass ?vendor=siemens or ?sector=energy. Returns advisory IDs, CVSS scores, CVE lists, OT severity, a…
Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Pass observed_processes? and/or obs…
AI/agentic copilot exposure lookup for OT/ICS vendors. Pass vendor (Siemens, Schneider Electric, Rockwell Automation, ABB, Emerson, Honeywell, Yokogawa, GE Vern…
Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor (optionally scoped to a sector). Same fan-out data as /o…
ICS threat actor ASN infrastructure profiling. Pass ?asn=AS215540. Returns ICS actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA,…
Sector threat brief for ICS/OT. Pass ?sector=energy&period=30. Returns active actors, new CVE counts, active campaigns, top advisories, and risk_trend (increasi…
Active ICS campaign tracker. Pass ?sector=electric&status=active. Returns campaigns currently targeting a sector with actor attribution, start date, targeted ge…
Compliance gap mapping for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443, NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, UAE NESA IA. Pa…
Aggregate compliance-gap assessment across multiple CVEs/actors in one call. Pass items=<comma-separated, max 25> (auto-detects CVE vs actor), optional framewor…