{"uid":"cap_PzkS-cqAYeWO3gnmAZaKc","slug":"ot-ics-remediation-action-conformance-gate-4b8ca631","name":"OT/ICS Remediation Action Conformance Gate","description":"Deterministic remediation risk gate. Pass actor, sector, region, planned_action (e.g. block_ip, halt_pipeline, disable_account). Returns auto_approve/human_review/reject via capability x opportunity x intent scoring (same as /ot/threat-score) — no LLM in the loop. auto_approve requires vendor_stack; omitting it caps the verdict at human_review regardless of score. Optional asset_context escalates to human_review on shared cloud/CDN infra (e.g. shared_infra:cloudflare).","url":"https://ot-intel-api.onrender.com/ot/action-conformance","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["actor","sector","region","planned_action"],"properties":{"actor":{"type":"string","description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"},"region":{"type":"string","description":"Target region e.g. GCC, KSA, UAE, Europe"},"sector":{"type":"string","description":"Target sector e.g. energy, water, manufacturing"},"vendor_stack":{"type":"string","description":"Comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC' — feeds the underlying threat-score's capability leg, same as /ot/threat-score. REQUIRED for auto_approve to be reachable at all; omitting it caps the verdict at human_review even if the underlying score would otherwise clear the auto-approve threshold."},"asset_context":{"type":"string","description":"Optional free text, e.g. 'shared_infra:cloudflare' — escalates to human_review when shared cloud/CDN infra is detected"},"planned_action":{"type":"string","description":"One of: block_ip, block_domain, quarantine_host, isolate_segment, halt_pipeline, disable_account"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"actor":"SANDWORM","region":"Europe","sector":"energy","rationale":"Threat score (8.2) is in the top decile of observed scores for vendor-specified queries — supports automated execution.","risk_tier":"auto_approve","data_sources":["OT-Intel-DB","GDELT Project (gdeltproject.org)","OFAC Sanctions List (US Treasury)"],"vendor_stack":["Siemens","Schneider Electric"],"asset_context":null,"planned_action":"block_ip","supporting_evidence":{"confidence":"moderate","threat_score":8.2,"shared_infra_detected":false,"vendor_stack_specified":true}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.12","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.12/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.12","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.12","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_TefC8FCTZbJZ9pyh-AmX9","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.12","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Evaluates a planned OT/ICS remediation action (e.g. block_ip, quarantine_host) against threat intelligence scoring rules and returns an auto_approve, human_review, or reject decision without LLM involvement.","exampleAgentPrompt":"Before I block the domain linked to SANDWORM activity targeting the energy sector in the GCC region, can you run a conformance check on that block_domain action — the asset is sitting behind shared Cloudflare infrastructure — and tell me whether it's auto-approved, needs human review, or should be rejected?","exampleUseCases":null,"resultDescription":"Returns a structured conformance verdict — one of auto_approve, human_review, or reject — derived from deterministic capability x opportunity x intent scoring rules. Includes the rationale for the decision, any escalation triggers (e.g. shared CDN/cloud infrastructure detected via asset_context), and an auditable rule trace with no LLM in the decision path.","failureModes":["Missing required parameters (actor, sector, region, planned_action) returns 400 with validation error","Unknown or unsupported planned_action enum value returns 400","Actor name not recognized in threat intelligence database may return low-confidence or default scoring","Render.com cold-start latency on first request may cause timeout","Payment failure or missing x402 header returns 402 Payment Required","asset_context with unrecognized shared infra tags may not trigger escalation logic"],"whenToPreferThis":"Use this endpoint when an automated OT/ICS incident response workflow needs a deterministic, auditable go/no-go gate before executing a remediation action — especially when regulatory compliance or shared infrastructure risk requires a human-in-the-loop check. Prefer this over LLM-based judgment or generic SOAR rules when the decision must be explainable and reproducible, and when you need sector/region/actor-specific risk context baked into the approval logic.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:52:02.911Z","isFirstParty":false}