{"uid":"cap_fXwNo1cUnGvFPBb8cvBb3","slug":"ot-ics-ioc-ttp-sighting-submission-c666ace4","name":"OT/ICS IOC/TTP Sighting Submission","description":"Submit an anonymized IOC/TTP sighting observed in your own OT environment. Pass ioc_or_ttp_id, sector, region (actor_name, observed_at optional). Feeds the correlation corpus without storing an org identifier. Written to a separate sightings store, not intel.db.","url":"https://ot-intel-api.onrender.com/ot/sighting/submit","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ioc_or_ttp_id","sector","region"],"properties":{"region":{"type":"string","description":"Region where this was observed e.g. KSA, UAE"},"sector":{"type":"string","description":"Sector where this was observed e.g. energy, water"},"actor_name":{"type":"string","description":"Optional actor name if the sighting is attributed"},"observed_at":{"type":"string","description":"Optional ISO 8601 timestamp of observation"},"ioc_or_ttp_id":{"type":"string","description":"CVE ID, MITRE ATT&CK-for-ICS technique ID, or sha256 hash"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_J2VfOlplu8Ia7WmVk1FHg","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Submits an anonymized IOC or TTP sighting observed in an OT/ICS environment to enrich a shared threat correlation corpus, without storing any organizational identifier.","exampleAgentPrompt":"Can you submit an anonymous sighting to the OT threat corpus — we observed MITRE ATT&CK ICS technique T0814 in our energy sector facility in KSA, attributed to CHERNOVITE, at 2024-11-15T10:30:00Z?","exampleUseCases":[{"title":"Energy sector TTP sighting report","prompt":"Submit an anonymous OT sighting for MITRE ATT&CK ICS technique T0816 observed in our energy sector network in UAE — attribute it to KOSTOVITE and log the time as 2025-01-20T08:00:00Z."},{"title":"Water utility IOC contribution","prompt":"Report a SHA256 hash a4f3c2e1b9d8f7a6c5e4d3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a3f2 that we spotted on an ICS device in our water sector environment in the EU region — no attribution yet."},{"title":"Anonymous CVE sighting in manufacturing","prompt":"I need to anonymously contribute a CVE-2023-28771 sighting we detected in our manufacturing plant in Germany — no actor attribution, just log it for the OT correlation corpus."}],"resultDescription":"A confirmation that the sighting has been written to the dedicated sightings store and will feed the OT threat correlation corpus. No organizational identifier is retained in the response or the stored record.","failureModes":["Missing required parameters (ioc_or_ttp_id, sector, or region) returns a 400 error","Invalid IOC/TTP ID format (not a CVE, MITRE ATT&CK ICS technique, or SHA256) may be rejected or silently accepted with reduced correlation value","Invalid ISO 8601 timestamp in observed_at returns a validation error","Service unavailable on Render cold-start delays may cause timeout on first request","Payment not processed (x402 protocol failure) results in 402 response and no sighting stored"],"whenToPreferThis":"Choose this endpoint when you want to anonymously contribute OT/ICS threat sightings to a shared correlation corpus without exposing your organization's identity. It is specifically designed for OT environments and accepts CVEs, MITRE ATT&CK for ICS technique IDs, and SHA256 hashes — making it preferable over generic threat intel submission APIs when your focus is industrial control system threats in specific sectors and regions.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:58:37.431Z","isFirstParty":false}