{"uid":"cap_cguslum218ddINddm8g_l","slug":"ot-intel-api-stix-coverage-lookup-50ff0c77","name":"OT Intel API – STIX Coverage Lookup","description":"Deterministic STIX representability + actionability lookup, grounded in Hahn/Krief et al. (arXiv:2512.18714v3, Jan 2026). Pass technique_id (MITRE ATT&CK ICS ID, optionally campaign=Triton|Stuxnet|Industroyer), protocol, or cve_id. Returns whether STIX 2.1 can represent the artifact (full/partial/none) and whether reporting gave enough detail to build a detection. Answers what STIX sharing alone can't tell you: is this actually actionable once shared. No LLM in the lookup path.","url":"https://ot-intel-api.onrender.com/ot/stix-coverage","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"cve_id":{"type":"string","description":"CVE ID from the paper's 8-row CISA KEV table, e.g. CVE-2023-3595. At least one of technique_id, protocol, or cve_id is required."},"campaign":{"type":"string","description":"Optional filter: Triton, Stuxnet, or Industroyer — narrows a technique_id lookup to one case study."},"protocol":{"type":"string","description":"ICS protocol name, e.g. TriStation, S7Comm, IEC 61850 MMS, CIP. At least one of technique_id, protocol, or cve_id is required."},"technique_id":{"type":"string","description":"MITRE ATT&CK ICS technique ID, e.g. T0836. At least one of technique_id, protocol, or cve_id is required."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"query":{"cve_id":null,"campaign":"Stuxnet","protocol":null,"technique_id":"T0836"},"source":"Hahn, Krief, Rebori-Carretero, Puzis, Elyashar & Urlaub, arXiv:2512.18714v3 (Jan 2026)","corpus_stats":{"actionable":87,"not_actionable":274,"no_stix_support":69,"full_stix_support":101,"partial_stix_support":191,"total_observables_scored":361},"technique_result":{"matches":[{"artifact":"Profibus messages to frequency-converter drives","campaign":"Stuxnet","proprietary":"open_standard","stix_object":"NetworkTraffic:src/dst_payload_ref","stix_support":"partial","technique_id":"T0836","artifact_detail":"described","parser_available":"no"}],"cross_campaign_variance":false}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.2","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.2/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.2","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.2","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_5rrh4kuwHZyqK6Mj-E7-5","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.2","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns STIX object coverage and actionability scoring for ICS/OT threat observables, mapped from academic research to ATT&CK-for-ICS techniques, CVEs, and ICS protocols.","exampleAgentPrompt":"Check the STIX coverage for ATT&CK ICS technique T0836 filtered to the Stuxnet campaign — I need to know which artifacts have full vs partial STIX support and whether parsers are available.","exampleUseCases":[{"title":"ICS detection engineering gap analysis","prompt":"Pull the STIX coverage for ATT&CK ICS technique T0840 and tell me which observable artifacts are actionable and whether any parsers exist — I'm building detection rules for my ICS SOC."},{"title":"Protocol-based STIX mapping for S7Comm","prompt":"What STIX objects cover S7Comm protocol observables in ICS threat intelligence? I need to know if coverage is full, partial, or missing so I can prioritize which gaps to fill."},{"title":"CVE triage with STIX supportability check","prompt":"For CVE-2023-3595 from the CISA KEV list, what STIX coverage exists and is the observable data actionable for automated detection? I'm evaluating whether my SIEM can ingest it natively."}],"resultDescription":"Returns a JSON object including the query echo, the academic source citation, corpus-level statistics (total observables scored, actionable count, STIX support breakdown), and per-technique or per-CVE/protocol artifact matches with fields for STIX object type, support level (full/partial/none), artifact detail quality, parser availability, and cross-campaign variance flag.","failureModes":["Missing all required query params (technique_id, protocol, cve_id) returns 400 — at least one must be supplied","Unknown technique ID or CVE not in the academic corpus returns empty matches array","Invalid campaign filter value (not Triton/Stuxnet/Industroyer) may return no results","Service hosted on Render free tier may cold-start with latency spike on first request","Payment not processed (x402) blocks request before reaching the endpoint logic"],"whenToPreferThis":"Use this endpoint when you need to assess whether a specific ICS/OT threat observable — identified by ATT&CK technique, CVE, or ICS protocol — has standardized STIX representation and automated detection feasibility, grounded in peer-reviewed academic research. Prefer this over generic CTI databases when the question is specifically about STIX schema coverage gaps for OT environments or when building detection engineering pipelines for industrial SOCs.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:56:27.979Z","isFirstParty":false}