{"uid":"cap_j7rKxcsnks8ZM2-qvPrqk","slug":"ot-att-ck-for-ics-precursor-ttp-classifier-accc571b","name":"OT ATT&CK-for-ICS Precursor TTP Classifier","description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup against intel.db. Not LLM-generated.","url":"https://ot-intel-api.onrender.com/ot/precursor-ttp","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["actor"],"properties":{"actor":{"type":"string","description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.04","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.04/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.04","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.04","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_I9lHiQs46HSXobXTI9eBp","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.04","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Classifies a named ICS/OT threat actor's known ATT&CK-for-ICS TTPs into pre-impact (recon through C2) vs impact-stage categories using deterministic tactic-taxonomy lookup.","exampleAgentPrompt":"Can you look up SANDWORM's ATT&CK-for-ICS TTPs and tell me which ones are pre-impact precursors versus impact-stage techniques — I want to know what early-warning signals to watch for before any physical disruption?","exampleUseCases":[{"title":"Classify VOLTZITE early-warning TTPs","prompt":"Can you pull up VOLTZITE's ATT&CK-for-ICS techniques and break them down into pre-impact versus impact-stage buckets? I want to know which tactics are early-warning signals I should be alerting on before they get to process disruption."},{"title":"Identify XENOTIME impact-stage techniques","prompt":"I need to understand XENOTIME's known TTPs — specifically which ones fall into inhibit-response-function or impair-process-control. Can you classify their full technique set so I can see what the impact-stage looks like versus the earlier reconnaissance and C2 activity?"},{"title":"Assess PIPEDREAM pre-impact versus impact","prompt":"We're doing a threat assessment on PIPEDREAM and I need to know whether their known ATT&CK-for-ICS tactics are still in the pre-impact window or if they include techniques that indicate active process disruption. Can you give me that tactic-stage breakdown?"}],"resultDescription":"A structured breakdown of the named actor's known ATT&CK-for-ICS TTPs bucketed into pre-impact tactics (reconnaissance through command-and-control — the early-warning window) and impact-stage tactics (inhibit-response-function, impair-process-control, impact), derived from a deterministic lookup against an intel database without LLM inference.","failureModes":["Unknown or unrecognized actor name returns empty or 404 response","Actor name typo or alternate naming convention causes no-match","Actor has no recorded ATT&CK-for-ICS TTPs in the intel.db, returning empty buckets","Service cold-start latency on Render.com free tier may cause initial timeout","Missing required 'actor' query parameter returns 400 bad request"],"whenToPreferThis":"Choose this endpoint when you need a deterministic, non-hallucinated tactic-stage classification for a specific named ICS/OT threat actor and want to distinguish early-warning pre-impact TTPs from impact-stage techniques using the ATT&CK-for-ICS framework. Prefer this over general CTI feeds when the use case is specifically ICS/OT adversary tactic staging and you need SOC-ready, taxonomy-grounded output without LLM inference risk.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:55:40.258Z","isFirstParty":false}