ot-intel-api.onrender.com · 5 listed services · provider site
Recurring public "State of OT Threat Intel — GCC" sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Pass optional issue_date (YYYY-MM-DD) for a past edition; omit for the lates...
ICS threat actors by sector. Pass ?sector=energy. Returns all groups targeting that sector from live MITRE ATT&CK ICS STIX data. Covers energy, water, manufacturing, oil-and-gas, chemical, transportation, nuclear.
Active ICS campaign tracker. Pass ?sector=electric&status=active. Returns campaigns currently targeting a sector with actor attribution, start date, targeted geography, TTPs in use, and CVEs being exploited. No free equi...
IOC enrichment with ICS campaign context. Pass ?value=1.2.3.4&type=ip or type=domain. Queries AlienVault OTX, AbuseIPDB, and DeepSeek CTI for OT campaign association. Returns verdict on whether the IOC is linked to ICS-t...
OT-contextualised CVE triage for ICS/SCADA. Pass ?id=CVE-XXXX-XXXX. Returns OT-adjusted severity, cyber-physical impact, patch feasibility, CISA KEV status, and prioritised action. DeepSeek-enriched with live NVD and CIS...
Provider identity is derived from the domain or repository in the source record. If two vendors share a host, they appear together here — that is a limitation of the data, not a statement about ownership.