{"uid":"cap_TcDDVhI-8bloq7dMtHly8","slug":"ot-ics-sector-threat-brief-399f8b75","name":"OT/ICS Sector Threat Brief","description":"Sector threat brief for ICS/OT. Pass ?sector=energy&period=30. Returns active actors, new CVE counts, active campaigns, top advisories, and risk_trend (increasing/stable/decreasing). One call replaces 5+ chained calls. Ideal for weekly reporting and compliance dashboards.","url":"https://ot-intel-api.onrender.com/ot/brief","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["sector"],"properties":{"period":{"type":"string","description":"Lookback window in days, default 30"},"sector":{"type":"string","description":"Industrial sector e.g. energy, water, manufacturing, oil-and-gas, electric, nuclear"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"sector":"energy","new_cves":12,"freshness":"2026-06-13T10:00:00Z","confidence":"high","risk_trend":"increasing","period_days":30,"data_sources":["NVD","CISA-ICS-CERT","MITRE-ATT&CK-ICS","OT-Intel-DB","DeepSeek-CTI-Analysis"],"active_actors":["VOLTZITE","SANDWORM","BENTONITE"],"critical_cves":3,"top_advisories":[{"id":"ICSA-26-150-01","title":"Siemens SIMATIC S7-1500","cvss_max":9.8}],"active_campaigns":2,"recommended_actions":["Patch CVE-2023-38380 on all internet-facing Siemens devices","Monitor for LOTL techniques on OT-adjacent hosts","Review remote access paths into the energy DMZ"],"risk_trend_rationale":"VOLTZITE pre-positioning activity increased in Q2 2026 targeting US electric grid."}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"period":"30","sector":"energy"}}},"response":{"sector":"energy","new_cves":0,"freshness":"2026-06-16T17:40:34.317Z","confidence":"high","risk_trend":"increasing","period_days":30,"data_sources":["CISA-ICS-CERT","MITRE-ATT&CK-ICS","OT-Intel-DB","DeepSeek-CTI-Analysis"],"active_actors":["APT33","MuddyWater","OilRig"],"critical_cves":0,"top_advisories":[{"id":"ICSA-26-167-02","title":"Rockwell Automation RSLinx","cvss_max":null,"published":"Tue, 16 Jun 26 12:00:00 +0000","ot_severity":"UNKNOWN"},{"id":"ICSA-26-162-02","title":"Naxclow IoT Platform","cvss_max":null,"published":"Thu, 11 Jun 26 12:00:00 +0000","ot_severity":"UNKNOWN"},{"id":"ICSA-26-160-01","title":"Schneider Electric Modicon Network Managed Switches","cvss_max":null,"published":"Tue, 09 Jun 26 12:00:00 +0000","ot_severity":"UNKNOWN"},{"id":"ICSA-26-160-03","title":"Schneider Electric EcoStruxure Panel Server","cvss_max":null,"published":"Tue, 09 Jun 26 12:00:00 +0000","ot_severity":"UNKNOWN"},{"id":"ICSA-26-160-02","title":"Siemens KACO Blueplanet Inverters","cvss_max":null,"published":"Tue, 09 Jun 26 12:00:00 +0000","ot_severity":"UNKNOWN"}],"active_campaigns":2,"recommended_actions":["Deploy ICS anomaly detection to identify Industroyer-like protocol abuse","Enhance monitoring for Iranian APT activity across energy OT networks","Apply sector-specific advisories and segment IT/OT networks"],"risk_trend_rationale":"Geopolitical escalation and historical Industroyer targeting of energy grids indicate elevated threat to the energy sector."}},"exampleRequest":{"period":"30","sector":"energy"},"tags":["x402"],"displayCostAmount":"0.1","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.1/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_oD0y1xXEuwxrP2T3oC-M6","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.1","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a consolidated ICS/OT threat intelligence brief for a given industrial sector and lookback period, including active threat actors, new CVE counts, active campaigns, top advisories, and risk trend.","exampleAgentPrompt":"Give me a full ICS threat brief for the energy sector covering the last 30 days — I need active threat actors, new CVE counts, active campaigns, top advisories, and whether the overall risk is increasing, stable, or decreasing.","exampleUseCases":null,"resultDescription":"A consolidated threat intelligence brief containing: list of active threat actors targeting the specified sector, count of new CVEs disclosed in the period, list of active ICS campaigns, top CISA/ICS-CERT advisories, and a risk_trend indicator (increasing/stable/decreasing).","failureModes":["Missing required 'sector' parameter returns 400 error","Unrecognized sector value may return empty or error response","Period value outside supported range may return 400 or default to 30 days","Service unavailable on Render cold-start may cause timeout or 503","Stale upstream threat intel feeds could produce outdated CVE counts or actor lists"],"whenToPreferThis":"Use this endpoint when you need a single aggregated OT/ICS threat intelligence snapshot for a sector rather than making multiple separate calls for actors, CVEs, campaigns, and advisories. Ideal for weekly reporting, compliance dashboards, or executive summaries where breadth matters more than deep detail on a single indicator. Prefer this over the individual sibling endpoints when you want a consolidated risk_trend signal alongside all key threat dimensions in one response.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T00:36:10.949Z","isFirstParty":false}