We count page visits with Google Analytics to see which pages are read. Nothing is stored until you accept, and we never store search queries. Privacy.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"ot-ics-threat-intelligence-api","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
CVE Triage — OT-contextualised CVE triage with OT-adjusted severity, CISA KEV status, and cyber-physical impact assessment.
Patch Feasibility — AI-powered patch feasibility assessment for OT/ICS environments with downtime estimation and deployment strategy.
Device Exposure Lookup — Internet-exposed OT device lookup by vendor/model with default credential risk and hardening recommendations.
ICS Threat Actor Profiles — ICS threat actor profiles with physical impact assessment, targeted sectors, and MITRE ATT&CK for ICS mapping.
Sector Threat Actor Mapping — All ICS threat actors targeting a specific industrial sector — energy, water, manufacturing, oil-and-gas, nuclear, chemical, transportation.
IOC Enrichment — IOC enrichment with ICS campaign context via AlienVault OTX — checks if indicator appears in OT-targeting threat feeds.
CISA ICS Advisory Feed — Live CISA ICS-CERT security advisories filtered by vendor or sector.
Asset Risk Verdict — Asset-specific risk score and escalation verdict for OT/ICS devices. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Firmware-aware when firmware param provided.
Active ICS Campaign Tracker — Active campaigns targeting a specific industrial sector right now. Returns campaign name, actor, start date, targeted geography, TTPs in use, and CVEs being exploited.
Sector Change Feed — What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes, not the full picture.
ICS Malware Encyclopedia — Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted protocols, attributed actor, and MITRE ATT&CK for ICS techniques.
Sector Threat Brief — Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls.
kind ← A2A Agent Card
name ← A2A Agent Card
summary ← A2A Agent Card
version ← A2A Agent Card
description ← A2A Agent Card
homepageUrl ← A2A Agent Card
publisherUrl ← A2A Agent Card
publisherName ← A2A Agent Card
Derived by Wellknown
Capabilities
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
4 h ago · declared · summary → "Hardware-aware threat intel for ICS/SCADA environments. 40 pay-per-call endpoints across primitive, analytical, and com
4 h ago · declared · description → "Hardware-aware threat intel for ICS/SCADA environments. 40 pay-per-call endpoints across primitive, analytical, and com
4 h ago · declared · publisherName → "OT Intel API"
4 h ago · declared · publisherUrl → "https://ot-intel-api.onrender.com"
4 h ago · declared · homepageUrl → "https://ot-intel-api.onrender.com/SKILL.md"
4 h ago · declared · version → "1.0.0"
4 h ago · declared · protocols → ["a2a"]
ICS Threat Actor ASN Infrastructure Profiling — Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE), phishing kit links, bulletproof hosting indicators, and OT-specific blocking recommendations. ASN analysis reveals infrastructure clustering that survives IP/domain rotation.
ICS Detection Artifact Retrieval — Returns YARA/Sigma detection rules for ICS malware families (PIPEDREAM, INDUSTROYER2, TRITON) and threat actors. Public corpus rules marked validated:true are safe for staging deployment. Synthesised rules carry validated:false. For automated threat hunting pipelines.
Multi-Framework Compliance Gap Mapping — Returns triggered controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic mapping shows which controls apply, compliance status, required action, and compensating controls. Optional framework= param filters to one standard. For automated compliance reporting agents.
Aggregate Compliance Gap Assessment — Rolls up compliance-gap mapping across multiple CVEs/threat actors in one call — deduplicated triggered controls, one aggregate severity rating (HIGH/MEDIUM/LOW/CLEAN), and a remediation summary. Same 11-framework coverage as ot-compliance-mapping. For agents triaging a batch of new advisories at once instead of one call per finding.
Actor-Target Threat Score — Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus live GDELT geopolitical tension and OFAC sanctions pressure signals. Not LLM-generated — the underlying score referenced by ot-risk-exposure and ot-action-conformance.
Precursor / Dwell-Time TTP Breakdown — Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup — no LLM in the classification path.
Statistical Anomaly Attribution — Ranks which sensors most likely drove a reported OT/ICS anomaly by statistical deviation (z-score) from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM. A statistical approximation of the attribution goal in Oswal et al. 2025 (kernel SHAP + temporal convolution autoencoder) — not a trained model, no SHAP values computed.
Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL) — Flags control-loop reconnaissance patterns and living-off-the-land/RMM-tool abuse from caller-submitted process and command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134) for the threat model, Dragos's control-loop mapping concept for the recon indicators. ADVISORY ONLY — never executes containment or any network action.
Physical Invariant Check — Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out over the same interval, via conservation of mass. Fully deterministic, no LLM. Loosely inspired by Barbhaya et al. 2025's physical-invariant residual check — not a reimplementation of their trained detection model. Flags inconsistency and direction; does not assert a specific cause.
OT/ICS Third-Party Vendor Risk — Supply-chain risk assessment for a specific OT/ICS vendor (e.g. Schneider Electric, Siemens, Rockwell Automation, ABB, Honeywell). Aggregates CVE, campaign, and threat actor mentions associated with the vendor and returns risk tier, confidence, and prescriptive supply-chain mitigation recommendations. Certain restricted-license third-party sources are excluded from analysis.
D3FEND-Mapped Mitigation Guidance — Maps MITRE ATT&CK for ICS techniques to MITRE D3FEND defensive countermeasures for a given threat actor, CVE, or technique ID. The technique-to-D3FEND mapping is always deterministic (local crosswalk); DeepSeek only selects the relevant technique when actor/CVE is given, and writes prescriptive architecture recommendations.
Board/GRC Portfolio Risk Aggregator — Aggregates deterministic threat-scores across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written board-level executive summary (BLUF, ICD-203 language). Optional compliance_framework param noted qualitatively in the narrative. For vCISO agents and GRC/board-reporting automation — portfolio-level companion to ot-threat-score.
Remediation Action Risk Gate — Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as ot-threat-score, with auditable rules layered on top — no LLM in the decision path. For agents that need a governance checkpoint before executing high-impact actions.
AI/Agentic Copilot Attack Surface Lookup — Deterministic lookup of a vendor's publicly documented AI/agentic copilot in their OT/ICS product line, its autonomy level (advisory vs agentic — the primary risk differentiator), and the MITRE ATLAS techniques that apply given its access level. Hand-verified mapping, ATLAS IDs confirmed directly against the live matrix. No LLM in the lookup path.
Attacker AI-Uplift Exposure — Assesses how much a general-purpose AI agent (Claude, GPT) lowers the skill/time barrier for an attacker to find and reach a vendor's OT-adjacent footprint. Grounded in Dragos's May 2026 'AI in the Breach' precedent, not frontier-model governance thresholds. Distinct from ot-ai-exposure, which looks up a vendor's OWN embedded AI copilot. DeepSeek-synthesised over CTI corpus plus caller-declared deployment context.
LLM-Generated ICS Attack Feasibility — Deterministic lookup against one specific empirical study (Cook et al., ACM TOPS 2026) testing whether off-the-shelf LLMs (GPT-4o, Gemini, DeepSeek, Qwen, LLaMA — Claude excluded by the paper's own authors due to stronger safety guardrails) can generate working attack code against real PLCs. Narrow scope: only 3 vendors tested, only network/register-tags techniques ever succeeded, 1.08% overall success rate. Distinct from ot-ai-exposure (vendor's own AI copilot) and ot-ai-uplift (open-ended rec…
CTI Claim Reliability Scoring — Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Flags constrained_generalization and caps confidence at low whenever no grounding text i…
STIX Representability + Actionability Lookup — Deterministic lookup grounded in Hahn, Krief, Rebori-Carretero, Puzis, Elyashar & Urlaub, 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering — answering what STIX sharing alone can't tell you. No LLM in the lookup path.
Analyst Brief — BLUF-style decision-ready analyst brief with key judgments and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector.
Vendor-Swap Risk Comparison — Counterfactual comparison of two OT/ICS vendors' risk tiers, for pre-purchase or migration decisions.
Submit OT Sighting — Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment, feeding the correlation corpus without storing an org identifier.
GCC OT Threat Sitrep (Public Bulletin) — Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish.
Threat Actor Report — Synthesised Markdown threat actor report for ICS/OT — executive summary, TTPs, campaigns, malware, and recommended actions. TLP: WHITE.
Deep Actor Dossier — Deep actor intelligence dossier — full profile, infrastructure, IOC table, detection rules, and kill chain mapping. Most comprehensive single-call artifact available.
Sector Situation Report — 30-day sector situation report — threat landscape, top actors, new advisories, what changed, compliance posture, and recommended priorities.