{"uid":"cap_tT7w83HYBZqsylnEekdAB","slug":"ot-intel-api-cti-claim-reliability-scorer-814da898","name":"OT Intel API - CTI Claim Reliability Scorer","description":"CTI claim reliability scoring, grounded in Meng et al. (arXiv:2509.23573, Feb 2026). Pass claim=<text>, optionally actor= and/or cve_id= to ground against intel.db. Classifies the claim against three failure modes — spurious correlation, contradictory knowledge, constrained generalization — and returns a reliability score, verdict, and evidence. The confidence layer threat-score/dossier/report don't expose.","url":"https://ot-intel-api.onrender.com/ot/claim-reliability","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["claim"],"properties":{"actor":{"type":"string","description":"Optional actor name to ground the claim against intel.db, e.g. SANDWORM."},"claim":{"type":"string","description":"The CTI claim to assess, e.g. an actor-targeting, attribution, or TTP claim."},"cve_id":{"type":"string","description":"Optional CVE ID to ground the claim against intel.db."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"tlp":"TLP:CLEAR","actor":"SANDWORM","claim":"SANDWORM has expanded targeting to water-sector Modbus deployments in the Gulf region","source":"Meng et al., arXiv:2509.23573v3 (Feb 2026)","verdict":"unverifiable","reasoning":"No intel.db records corroborate a Gulf-region water-sector shift for SANDWORM; existing reporting concentrates on Ukraine/Europe energy targeting.","confidence":"low","grounded_in_db":true,"reliability_score":0.35,"failure_mode_flags":["constrained_generalization"],"contradicting_evidence":["intel.db campaign records show SANDWORM activity concentrated in European energy/grid targets, not Gulf water utilities"],"corroborating_evidence":[]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.2","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.2/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.2","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.2","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_fI4cjRvgRWqfgAMdDzKFS","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.2","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scores the reliability of a cyber threat intelligence claim by classifying it against three LLM failure modes and returning a verdict with supporting evidence","exampleAgentPrompt":"Score the reliability of this threat intel claim: 'SANDWORM is actively exploiting CVE-2021-44228 to target Ukrainian energy grid SCADA systems' — check it against CVE-2021-44228 and actor SANDWORM.","exampleUseCases":[{"title":"Validate LLM-generated threat attribution","prompt":"I got this threat intel from an AI tool: 'APT33 is using CVE-2022-30190 to attack oil and gas ICS networks in the Middle East.' Can you score how reliable that claim is and tell me if it's a hallucination or grounded in real evidence?"},{"title":"Screen unverified threat feed claims","prompt":"Our threat feed just pushed this claim: 'VOLTZITE is actively targeting water treatment SCADA systems using spear-phishing campaigns tied to CVE-2023-27350.' Before we escalate this to the SOC, score its reliability and flag any failure modes."},{"title":"Audit CVE-actor association accuracy","prompt":"Someone on our red team is asserting that TRITON actors are exploiting CVE-2019-13945 against nuclear facility safety instrumented systems. Can you verify whether that CVE-actor association is actually supported by intel and give me a verdict with evidence?"}],"resultDescription":"Returns a reliability score (numeric), a verdict (e.g. reliable/unreliable/uncertain), classification of which LLM failure mode applies (spurious correlation, contradictory knowledge, or constrained generalization), and grounding evidence drawn from intel.db","failureModes":["Missing required 'claim' query parameter — returns 400 or error response","CVE ID not found in intel.db — reduced grounding, lower confidence score","Actor name unrecognized — claim assessed without actor-specific grounding","Claim is ambiguous or too short to classify against failure modes — low confidence verdict","Service cold-start latency on Render free tier — first request may time out"],"whenToPreferThis":"Use this endpoint when you need to programmatically verify or score a specific CTI claim's reliability — especially when the claim was generated by an LLM or sourced from unverified threat feeds — and want structured failure-mode classification grounded in OT/ICS threat actor and CVE intel. Prefer over general LLM prompting when you need a deterministic, scored verdict tied to a research-backed taxonomy (Meng et al. arXiv:2509.23573).","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:54:53.917Z","isFirstParty":false}