{"uid":"cap_8a_LnvL6NOG-Pw3Vewmbp","slug":"ot-intel-api-root-cause-localization-sensor-z-score-ranking-b0a7e241","name":"OT Intel API – Root Cause Localization (Sensor Z-Score Ranking)","description":"Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor baseline, given a caller-supplied telemetry window. Pass window=<JSON array, max 20>: [{sensor_id, values[], baseline_mean?, baseline_stddev?}], optional top_k (default 5), anomaly_event_id. Fully deterministic, no LLM, no trained model. Statistical approximation inspired by Oswal et al. 2025 kernel-SHAP/TCAE work — not a reimplementation of it.","url":"https://ot-intel-api.onrender.com/ot/xai/root-cause-localization","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["window"],"properties":{"top_k":{"type":"string","description":"How many ranked sensors to return, default 5 (numeric string)"},"window":{"type":"string","description":"URL-encoded JSON array, max 20 entries: [{sensor_id, values[], baseline_mean?, baseline_stddev?}]"},"anomaly_event_id":{"type":"string","description":"Optional correlation ID, echoed back unchanged"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.15","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.15/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.15","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.15","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_MK6OAOoVia5xuj0NyJc6j","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.15","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Ranks which OT/ICS sensors most likely caused a reported anomaly by computing z-score deviations from each sensor's baseline, returning a deterministic ordered list of suspect sensors.","exampleAgentPrompt":"We just had an anomaly event ID EVT-2041 on our SCADA system — here are readings from 5 sensors over the last 10 minutes with their baselines. Can you rank which sensors deviated the most from normal and give me the top 3 most likely root causes?","exampleUseCases":[{"title":"ICS incident triage after pipeline anomaly","prompt":"We got an alert on our natural gas pipeline control system, event ID PIPE-887. I have telemetry for 8 sensors from the last 15-minute window along with their historical means and standard deviations. Rank the top 5 sensors by how far they deviated from baseline so I know where to start investigating."},{"title":"Automated SOC enrichment for SCADA alert","prompt":"Our SOC tool just flagged anomaly event ALT-3310 in our water treatment SCADA. Feed it these 12 sensor readings and their baselines and tell me which 3 sensors are the most anomalous — I want to automatically triage this before escalating to an engineer."},{"title":"Post-incident sensor attribution report","prompt":"After last night's pressure incident on the factory floor, event ID FAC-0055, I want to know which of these 20 sensors showed the biggest z-score deviations from their normal operating ranges. Give me the full ranked list so I can document root cause attribution."}],"resultDescription":"An ordered list of up to top_k sensors ranked by z-score magnitude away from their baseline, including each sensor's ID, computed z-score, and deviation direction. The optional anomaly_event_id is echoed back for correlation. The result is fully deterministic — no ML model or LLM is involved.","failureModes":["window array exceeds 20 entries — request is rejected","missing required window parameter — returns 400-level error","malformed or non-URL-encoded JSON in window parameter — parse error","baseline_mean or baseline_stddev missing and cannot be inferred — may return degraded or partial results","top_k value is non-numeric or out of range — defaults to 5 or error","payment not processed — 402 response blocking access"],"whenToPreferThis":"Choose this endpoint when you need fast, deterministic, statistically-grounded sensor ranking for OT/ICS anomaly triage and do not want to rely on an LLM or trained model. It is ideal for industrial SOC automation workflows where auditability and reproducibility of root cause attribution matter. Prefer it over ML-based approaches when you have per-sensor baseline statistics available and need a transparent z-score explanation an operator can verify.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:57:10.648Z","isFirstParty":false}