{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_8yc2dsqkk8fe","handle":"ot-ics-threat-intelligence-api","url":"https://wellknown.network/agents/ot-ics-threat-intelligence-api","links":{"self":"https://wellknown.network/agents/ot-ics-threat-intelligence-api/record.json","html":"https://wellknown.network/agents/ot-ics-threat-intelligence-api","markdown":"https://wellknown.network/agents/ot-ics-threat-intelligence-api/record.md","api":"https://wellknown.network/api/v1/agents/ot-ics-threat-intelligence-api","status":"https://wellknown.network/api/v1/agents/ot-ics-threat-intelligence-api/status","claim":"https://wellknown.network/agents/ot-ics-threat-intelligence-api/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/ot-ics-threat-intelligence-api/claim.json","badge":"https://wellknown.network/agents/ot-ics-threat-intelligence-api/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/ot-ics-threat-intelligence-api/history","tools":"https://wellknown.network/api/v1/agents/ot-ics-threat-intelligence-api/tools"},"ard":{"identifier":"urn:air:ot-intel-api.onrender.com:agent:ot-ics-threat-intelligence-api","type":"application/a2a-agent-card+json"},"kind":"agent","declared":{"name":"OT/ICS Threat Intelligence API","summary":"Hardware-aware threat intel for ICS/SCADA environments. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers: CVE triage, patch feasibility, internet-exposed device lookup, ICS threat actor profiles, sector threat mapping, IOC enrichment, live CISA advisory feed, ass…","description":"Hardware-aware threat intel for ICS/SCADA environments. 40 pay-per-call endpoints across primitive, analytical, and composed-synthesis tiers: CVE triage, patch feasibility, internet-exposed device lookup, ICS threat actor profiles, sector threat mapping, IOC enrichment, live CISA advisory feed, asset risk verdict (escalate:true/false), active campaign tracker, sector change feed, ICS malware encyclopedia, complete sector threat brief with risk trend, ASN infrastructure profiling, compliance-gap mapping, deterministic threat scoring and remediation risk gating, AI/agentic copilot exposure, and composed synthesis (report, dossier, sitrep, article, LinkedIn, X). DeepSeek-enriched. No API keys — pure USDC micropayments on Base via x402.","publisher":{"name":"OT Intel API","url":"https://ot-intel-api.onrender.com"},"homepage":"https://ot-intel-api.onrender.com/SKILL.md","repository":null,"version":"1.0.0","license":null,"protocols":["a2a"],"tags":["cve","ics","scada","vulnerability","security","patch","vulnerability management","device","exposure","shodan","threat actor","apt","mitre","sector","energy","critical infrastructure","ioc","threat intel","otx","cisa","advisory","risk-score","triage","escalation","asset-risk","campaign","active-threat","sector-monitoring","delta","change-feed","monitoring","cron","malware","pipedream","triton","industroyer","brief","threat-brief","sector-report","risk-trend"],"pricing":null,"endpoints":[{"url":"https://ot-intel-api.onrender.com","type":"a2a","auth":"none","probeable":true}],"skills":[{"id":"ot-cve-triage","name":"CVE Triage","tags":["cve","ics","scada","vulnerability","security"],"description":"OT-contextualised CVE triage with OT-adjusted severity, CISA KEV status, and cyber-physical impact assessment."},{"id":"ot-patch-feasibility","name":"Patch Feasibility","tags":["patch","ics","scada","vulnerability management"],"description":"AI-powered patch feasibility assessment for OT/ICS environments with downtime estimation and deployment strategy."},{"id":"ot-device-exposure","name":"Device Exposure Lookup","tags":["device","ics","scada","exposure","shodan"],"description":"Internet-exposed OT device lookup by vendor/model with default credential risk and hardening recommendations."},{"id":"ot-threat-actor","name":"ICS Threat Actor Profiles","tags":["threat actor","apt","ics","scada","mitre"],"description":"ICS threat actor profiles with physical impact assessment, targeted sectors, and MITRE ATT&CK for ICS mapping."},{"id":"ot-actor-sector","name":"Sector Threat Actor Mapping","tags":["threat actor","sector","ics","energy","critical infrastructure"],"description":"All ICS threat actors targeting a specific industrial sector — energy, water, manufacturing, oil-and-gas, nuclear, chemical, transportation."},{"id":"ot-ioc-enrichment","name":"IOC Enrichment","tags":["ioc","threat intel","ics","scada","otx"],"description":"IOC enrichment with ICS campaign context via AlienVault OTX — checks if indicator appears in OT-targeting threat feeds."},{"id":"ot-cisa-advisory","name":"CISA ICS Advisory Feed","tags":["cisa","advisory","ics","scada","vulnerability"],"description":"Live CISA ICS-CERT security advisories filtered by vendor or sector."},{"id":"ot-exposure","name":"Asset Risk Verdict","tags":["risk-score","ics","scada","triage","escalation","asset-risk"],"description":"Asset-specific risk score and escalation verdict for OT/ICS devices. Returns risk_score (0-100), escalate (boolean), recommended_action, and contributing threat actors. Firmware-aware when firmware param provided."},{"id":"ot-campaign","name":"Active ICS Campaign Tracker","tags":["campaign","ics","scada","active-threat","sector-monitoring"],"description":"Active campaigns targeting a specific industrial sector right now. Returns campaign name, actor, start date, targeted geography, TTPs in use, and CVEs being exploited."},{"id":"ot-delta","name":"Sector Change Feed","tags":["delta","change-feed","ics","scada","monitoring","cron"],"description":"What is NEW for a sector in the last N days — new CVEs, new CISA advisories, new actor activity. Designed for cron-based monitoring agents. Only returns changes, not the full picture."},{"id":"ot-malware","name":"ICS Malware Encyclopedia","tags":["malware","ics","scada","pipedream","triton","industroyer"],"description":"Structured profiles of known ICS malware: PIPEDREAM, TRITON, INDUSTROYER2, CRASHOVERRIDE, FROSTYLOOP, BLACKENERGY. Returns capabilities, targeted protocols, attributed actor, and MITRE ATT&CK for ICS techniques."},{"id":"ot-brief","name":"Sector Threat Brief","tags":["brief","threat-brief","ics","scada","sector-report","risk-trend","compliance"],"description":"Complete 30-day threat brief for an industrial sector. Returns active actors, new CVE counts, active campaigns, top advisories, risk trend (increasing/stable/decreasing), and top 3 recommended actions. One call replaces 5+ chained calls."},{"id":"ot-asn-profiling","name":"ICS Threat Actor ASN Infrastructure Profiling","tags":["asn","infrastructure","ics","threat-actor","bulletproof-hosting","c2","blocking"],"description":"Profiles an ASN for ICS threat actor infrastructure use. Returns actor associations (SANDWORM, VOLTZITE), phishing kit links, bulletproof hosting indicators, and OT-specific blocking recommendations. ASN analysis reveals infrastructure clustering that survives IP/domain rotation."},{"id":"ot-detection-artifacts","name":"ICS Detection Artifact Retrieval","tags":["detection","yara","sigma","ics","threat-hunting","siem","pipedream","triton"],"description":"Returns YARA/Sigma detection rules for ICS malware families (PIPEDREAM, INDUSTROYER2, TRITON) and threat actors. Public corpus rules marked validated:true are safe for staging deployment. Synthesised rules carry validated:false. For automated threat hunting pipelines."},{"id":"ot-compliance-mapping","name":"Multi-Framework Compliance Gap Mapping","tags":["compliance","nerc-cip","iec-62443","nist-csf","nca-otcc","nesa-ia","ics","gap-analysis","audit","cve"],"description":"Returns triggered controls for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443 (2-1/2-4/3-2/3-3/4-2), NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, and UAE NESA IA. Deterministic mapping shows which controls apply, compliance status, required action, and compensating controls. Optional framework= param filters to one standard. For automated compliance reporting agents."},{"id":"ot-compliance-batch","name":"Aggregate Compliance Gap Assessment","tags":["compliance","batch","nerc-cip","iec-62443","nist-csf","nca-otcc","nesa-ia","gap-analysis","audit"],"description":"Rolls up compliance-gap mapping across multiple CVEs/threat actors in one call — deduplicated triggered controls, one aggregate severity rating (HIGH/MEDIUM/LOW/CLEAN), and a remediation summary. Same 11-framework coverage as ot-compliance-mapping. For agents triaging a batch of new advisories at once instead of one call per finding."},{"id":"ot-threat-score","name":"Actor-Target Threat Score","tags":["threat-score","risk-scoring","ics","capability","opportunity","intent","geopolitical","sanctions"],"description":"Deterministic capability x opportunity x intent threat score for an actor-target pairing. Scored from actor/CVE/campaign data plus live GDELT geopolitical tension and OFAC sanctions pressure signals. Not LLM-generated — the underlying score referenced by ot-risk-exposure and ot-action-conformance."},{"id":"ot-precursor-ttp","name":"Precursor / Dwell-Time TTP Breakdown","tags":["ttp-analysis","dwell-time","early-warning","mitre-attck","ics","reconnaissance"],"description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup — no LLM in the classification path."},{"id":"ot-root-cause-localization","name":"Statistical Anomaly Attribution","tags":["anomaly-detection","root-cause","ics","scada","statistical","z-score"],"description":"Ranks which sensors most likely drove a reported OT/ICS anomaly by statistical deviation (z-score) from each sensor's own baseline, given a caller-supplied telemetry window. Fully deterministic, no LLM. A statistical approximation of the attribution goal in Oswal et al. 2025 (kernel SHAP + temporal convolution autoencoder) — not a trained model, no SHAP values computed."},{"id":"ot-threat-hunt-control-loop","name":"Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)","tags":["threat-hunting","advisory","rmm-abuse","living-off-the-land","ics","control-loop","keyword-matching"],"description":"Flags control-loop reconnaissance patterns and living-off-the-land/RMM-tool abuse from caller-submitted process and command observations. Fully deterministic keyword-pattern matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134) for the threat model, Dragos's control-loop mapping concept for the recon indicators. ADVISORY ONLY — never executes containment or any network action."},{"id":"ot-invariant-reachability","name":"Physical Invariant Check","tags":["physical-invariant","mass-balance","ics","scada","anomaly-detection","deterministic"],"description":"Checks whether a tank/vessel's reported level change is physically consistent with its reported flow-in/flow-out over the same interval, via conservation of mass. Fully deterministic, no LLM. Loosely inspired by Barbhaya et al. 2025's physical-invariant residual check — not a reimplementation of their trained detection model. Flags inconsistency and direction; does not assert a specific cause."},{"id":"ot-vendor-risk","name":"OT/ICS Third-Party Vendor Risk","tags":["third-party-risk","supply-chain","ics","vendor-risk","vulnerability","cve"],"description":"Supply-chain risk assessment for a specific OT/ICS vendor (e.g. Schneider Electric, Siemens, Rockwell Automation, ABB, Honeywell). Aggregates CVE, campaign, and threat actor mentions associated with the vendor and returns risk tier, confidence, and prescriptive supply-chain mitigation recommendations. Certain restricted-license third-party sources are excluded from analysis."},{"id":"ot-mitigation-map","name":"D3FEND-Mapped Mitigation Guidance","tags":["architecture","d3fend","mitre-attck","ics","mitigation","defense-in-depth"],"description":"Maps MITRE ATT&CK for ICS techniques to MITRE D3FEND defensive countermeasures for a given threat actor, CVE, or technique ID. The technique-to-D3FEND mapping is always deterministic (local crosswalk); DeepSeek only selects the relevant technique when actor/CVE is given, and writes prescriptive architecture recommendations."},{"id":"ot-risk-exposure","name":"Board/GRC Portfolio Risk Aggregator","tags":["grc","board-report","risk-exposure","executive-summary","ics","portfolio-risk"],"description":"Aggregates deterministic threat-scores across the actors relevant to a sector+region, ranks them, and returns a DeepSeek-written board-level executive summary (BLUF, ICD-203 language). Optional compliance_framework param noted qualitatively in the narrative. For vCISO agents and GRC/board-reporting automation — portfolio-level companion to ot-threat-score."},{"id":"ot-action-conformance","name":"Remediation Action Risk Gate","tags":["governance","remediation","risk-gate","automation","ics","human-in-the-loop"],"description":"Deterministic auto_approve/human_review/reject verdict for a planned remediation action (block_ip, quarantine_host, halt_pipeline, etc.) against an actor/sector/region context. Built on the same capability x opportunity x intent scoring as ot-threat-score, with auditable rules layered on top — no LLM in the decision path. For agents that need a governance checkpoint before executing high-impact actions."},{"id":"ot-ai-exposure","name":"AI/Agentic Copilot Attack Surface Lookup","tags":["ai-security","agentic-ai","mitre-atlas","copilot","ics","supply-chain"],"description":"Deterministic lookup of a vendor's publicly documented AI/agentic copilot in their OT/ICS product line, its autonomy level (advisory vs agentic — the primary risk differentiator), and the MITRE ATLAS techniques that apply given its access level. Hand-verified mapping, ATLAS IDs confirmed directly against the live matrix. No LLM in the lookup path."},{"id":"ot-ai-uplift","name":"Attacker AI-Uplift Exposure","tags":["ai-uplift","ai-security","reconnaissance","ics","supply-chain","it-ot-boundary"],"description":"Assesses how much a general-purpose AI agent (Claude, GPT) lowers the skill/time barrier for an attacker to find and reach a vendor's OT-adjacent footprint. Grounded in Dragos's May 2026 'AI in the Breach' precedent, not frontier-model governance thresholds. Distinct from ot-ai-exposure, which looks up a vendor's OWN embedded AI copilot. DeepSeek-synthesised over CTI corpus plus caller-declared deployment context."},{"id":"ot-ai-attack-feasibility","name":"LLM-Generated ICS Attack Feasibility","tags":["ai-security","llm-attack-synthesis","mitre-ics","empirical-study","ics","plc"],"description":"Deterministic lookup against one specific empirical study (Cook et al., ACM TOPS 2026) testing whether off-the-shelf LLMs (GPT-4o, Gemini, DeepSeek, Qwen, LLaMA — Claude excluded by the paper's own authors due to stronger safety guardrails) can generate working attack code against real PLCs. Narrow scope: only 3 vendors tested, only network/register-tags techniques ever succeeded, 1.08% overall success rate. Distinct from ot-ai-exposure (vendor's own AI copilot) and ot-ai-uplift (open-ended rec…"},{"id":"ot-claim-reliability","name":"CTI Claim Reliability Scoring","tags":["cti-reliability","evidence-verification","empirical-study","ics","confidence-scoring"],"description":"Grounded in Meng et al., 'Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence' (arXiv:2509.23573v3, Feb 2026). Classifies a CTI claim against the paper's three failure modes — spurious correlation, contradictory knowledge, constrained generalization — using intel.db grounding plus DeepSeek synthesis. Returns a reliability score, verdict, corroborating/contradicting evidence, and confidence. Flags constrained_generalization and caps confidence at low whenever no grounding text i…"},{"id":"ot-stix-coverage","name":"STIX Representability + Actionability Lookup","tags":["stix","threat-information-sharing","empirical-study","ics","detection-engineering"],"description":"Deterministic lookup grounded in Hahn, Krief, Rebori-Carretero, Puzis, Elyashar & Urlaub, 'An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems' (arXiv:2512.18714v3, Jan 2026). Returns whether STIX 2.1 can represent a technique/protocol/CVE's artifacts (full/partial/none) and whether public reporting gave enough technical detail to be actionable for detection engineering — answering what STIX sharing alone can't tell you. No LLM in the lookup path."},{"id":"ot-analyst-brief","name":"Analyst Brief","tags":["bluf","synthesis","ics","decision-support"],"description":"BLUF-style decision-ready analyst brief with key judgments and ICD-203 confidence assessment for a threat actor, optionally scoped to a sector."},{"id":"ot-vendor-risk-delta","name":"Vendor-Swap Risk Comparison","tags":["vendor-risk","counterfactual","supply-chain","procurement","ics"],"description":"Counterfactual comparison of two OT/ICS vendors' risk tiers, for pre-purchase or migration decisions."},{"id":"ot-sighting-submit","name":"Submit OT Sighting","tags":["crowdsourced","sighting","ioc","ttp","ics"],"description":"Submit an anonymized IOC/TTP sighting observed in the caller's own OT environment, feeding the correlation corpus without storing an org identifier."},{"id":"ot-gcc-bulletin","name":"GCC OT Threat Sitrep (Public Bulletin)","tags":["sitrep","gcc","public-bulletin","ics"],"description":"Recurring public 'State of OT Threat Intel — GCC' sitrep, human-reviewed before publish."},{"id":"ot-report","name":"Threat Actor Report","tags":["report","synthesis","ics","actor"],"description":"Synthesised Markdown threat actor report for ICS/OT — executive summary, TTPs, campaigns, malware, and recommended actions. TLP: WHITE."},{"id":"ot-dossier","name":"Deep Actor Dossier","tags":["dossier","synthesis","ics","actor"],"description":"Deep actor intelligence dossier — full profile, infrastructure, IOC table, detection rules, and kill chain mapping. Most comprehensive single-call artifact available."},{"id":"ot-sitrep","name":"Sector Situation Report","tags":["sitrep","synthesis","ics","sector"],"description":"30-day sector situation report — threat landscape, top actors, new advisories, what changed, compliance posture, and recommended priorities."},{"id":"ot-article","name":"CTI Article (Publication-Ready)","tags":["article","content","synthesis","ics"],"description":"Publication-ready CTI article (~700 words), journalist-style with headline, lede, body, ATT&CK context, defanged IOCs, and TLP marking."},{"id":"ot-linkedin","name":"LinkedIn Post","tags":["linkedin","content","synthesis","ics"],"description":"LinkedIn post for a CTI/ICS security audience — hook line, intelligence bullets, call to action, and hashtags. Ready to publish."},{"id":"ot-xpost","name":"X/Twitter Thread","tags":["twitter","x","content","synthesis","ics"],"description":"X/Twitter thread (5-7 posts) for an ICS actor or CVE — hook, intel posts with ATT&CK IDs, mitigation post, and hashtag post."}],"tools":["CVE Triage","Patch Feasibility","Device Exposure Lookup","ICS Threat Actor Profiles","Sector Threat Actor Mapping","IOC Enrichment","CISA ICS Advisory Feed","Asset Risk Verdict","Active ICS Campaign Tracker","Sector Change Feed","ICS Malware Encyclopedia","Sector Threat Brief","ICS Threat Actor ASN Infrastructure Profiling","ICS Detection Artifact Retrieval","Multi-Framework Compliance Gap Mapping","Aggregate Compliance Gap Assessment","Actor-Target Threat Score","Precursor / Dwell-Time TTP Breakdown","Statistical Anomaly Attribution","Advisory Threat Hunt (Control-Loop Recon / RMM-LOTL)","Physical Invariant Check","OT/ICS Third-Party Vendor Risk","D3FEND-Mapped Mitigation Guidance","Board/GRC Portfolio Risk Aggregator","Remediation Action Risk Gate","AI/Agentic Copilot Attack Surface Lookup","Attacker AI-Uplift Exposure","LLM-Generated ICS Attack Feasibility","CTI Claim Reliability Scoring","STIX Representability + Actionability Lookup","Analyst Brief","Vendor-Swap Risk Comparison","Submit OT Sighting","GCC OT Threat Sitrep (Public Bulletin)","Threat Actor Report","Deep Actor Dossier","Sector Situation Report","CTI Article (Publication-Ready)","LinkedIn Post","X/Twitter Thread"],"extra":{"capabilities":{"streaming":false,"pushNotifications":false,"stateTransitionHistory":false}},"attribution":{"kind":"a2a_card","name":"a2a_card","summary":"a2a_card","version":"a2a_card","description":"a2a_card","homepageUrl":"a2a_card","publisherUrl":"a2a_card","publisherName":"a2a_card"}},"derived":{"capabilities":[{"slug":"content.social","name":"Social Media","confidence":1,"provenance":"derived"},{"slug":"content.marketing","name":"Marketing","confidence":1,"provenance":"declared"},{"slug":"code.security-review","name":"Security Review","confidence":1,"provenance":"declared"},{"slug":"data.news","name":"News & Feeds","confidence":1,"provenance":"derived"},{"slug":"infra.devices","name":"Devices & IoT","confidence":1,"provenance":"declared"},{"slug":"analytics.reporting","name":"Reporting & Dashboards","confidence":1,"provenance":"derived"},{"slug":"dev.monitoring","name":"Monitoring & Observability","confidence":1,"provenance":"declared"},{"slug":"automation.scheduling","name":"Scheduling & Cron","confidence":1,"provenance":"declared"},{"slug":"research.people-companies","name":"People & Company Research","confidence":0.99,"provenance":"derived"},{"slug":"ai.evaluation","name":"Evaluation & Benchmarks","confidence":0.911,"provenance":"derived"}],"categories":["ai","analytics","automation","code","content","data","dev","infra","research"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 5h ago.","lastOkAt":"2026-10-22T16:31:19.274Z","lastProbedAt":"2026-10-22T16:31:19.274Z","statusComputedAt":"2026-10-22T16:33:35.366Z","reliability30d":{"probes":1,"successRate":1,"p50Ms":733,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":1,"ok":1,"authBoundaryOk":0,"serviceOk":1,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-10-22T16:31:19.274Z","kind":"a2a_card","ok":true,"httpStatus":200,"latencyMs":733,"error":null,"detail":{"name":"OT/ICS Threat Intelligence API","signed":false,"version":"1.0.0","cardPath":"/.well-known/agent-card.json","skillCount":40}}],"tools":null,"package":null,"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"a2a_card","key":"https://ot-intel-api.onrender.com/.well-known/agent-card.json","url":"https://ot-intel-api.onrender.com/.well-known/agent-card.json","firstSeenAt":"2026-10-22T16:21:36.889Z","fetchedAt":"2026-10-22T16:21:36.889Z","normalizedAt":"2026-10-22T16:21:36.889Z"}]},"firstSeenAt":"2026-10-22T16:21:36.889Z","updatedAt":"2026-10-22T16:21:47.234Z"}