{"uid":"cap_XLFO1KGlpNfNLV1aVxAzt","slug":"ot-intel-ics-sector-delta-feed-2c610eae","name":"OT-Intel ICS Sector Delta Feed","description":"ICS sector change feed — only what is NEW in the last N days. Pass ?sector=water&days=7. Returns new CVEs, new CISA advisories, and new actor activity since the last call. Designed for cron-based monitoring agents. Eliminates redundant reprocessing.","url":"https://ot-intel-api.onrender.com/ot/delta","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["sector"],"properties":{"days":{"type":"string","description":"Lookback window in days, default 7, max 30"},"sector":{"type":"string","description":"Industrial sector e.g. energy, water, manufacturing, oil-and-gas, electric"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"since":"2026-06-06T00:00:00Z","sector":"water","new_cves":[{"id":"CVE-2026-1234","cvss":9.1,"ot_severity":"critical","affected_vendors":["Schneider Electric"]}],"freshness":"2026-06-13T10:00:00Z","net_change":"1 new critical CVE, 1 new advisory","data_sources":["NVD","CISA-ICS-CERT","MITRE-ATT&CK-ICS"],"new_advisories":[{"id":"ICSA-26-164-01","title":"Schneider Electric Modicon","cvss_max":9.1}],"new_actor_activity":[]}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"days":"7","sector":"water"}}},"response":{"since":"2026-06-09T17:39:09.845Z","sector":"water","new_cves":[],"freshness":"2026-06-16T17:39:12.050Z","net_change":"0 new CVEs, 2 new advisories, 3 actor updates","period_days":7,"data_sources":["CISA-ICS-CERT","DeepSeek-CTI-Analysis"],"new_advisories":[{"id":"ICSA-26-167-02","title":"Rockwell Automation RSLinx","cvss_max":null,"published":"Tue, 16 Jun 26 12:00:00 +0000"},{"id":"ICSA-26-162-02","title":"Naxclow IoT Platform","cvss_max":null,"published":"Thu, 11 Jun 26 12:00:00 +0000"}],"new_actor_activity":[{"actor":"UNC2891","confidence":"medium","activity_type":"Targeted intrusion attempts against water treatment facilities"},{"actor":"Volt Typhoon","confidence":"medium","activity_type":"Pre-positioning activity in water sector OT networks"},{"actor":"GhostSec","confidence":"low","activity_type":"Ransomware attack on small water utility"}]}},"exampleRequest":{"days":"7","sector":"water"},"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_J7Vg3rXSYeTBD4MvpBgqn","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns only new CVEs, CISA advisories, and threat actor activity for a given ICS/OT sector since the last N days — a change-only feed for efficient cron-based monitoring.","exampleAgentPrompt":"Check what's new in ICS threat intelligence for the water sector over the last 7 days — just give me the new CVEs, fresh CISA advisories, and any new threat actor activity, nothing I've already seen.","exampleUseCases":null,"resultDescription":"A delta feed containing only items that are new within the specified lookback window: newly disclosed CVEs relevant to the sector, newly published CISA ICS-CERT advisories, and new threat actor activity targeting that industrial sector. Designed to avoid redundant reprocessing of previously seen data.","failureModes":["Missing required 'sector' or 'days' query parameters returns an error","Invalid sector name (not in supported enum) returns no results or an error","'days' value exceeding 30 may be clamped or rejected","Render.com cold-start latency may cause slow first response after idle period","If upstream threat intel sources are unavailable, delta may be incomplete or stale"],"whenToPreferThis":"Choose this endpoint when you need to run recurring, scheduled monitoring of ICS/OT threat intelligence for a specific industrial sector without reprocessing previously seen data. Ideal for cron-based agents, alerting pipelines, or automated security workflows that need only what is genuinely new since the last poll. Prefer this over full-feed endpoints when efficiency and incremental updates matter.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:37:29.998Z","isFirstParty":false}