{"id":"111a418f-2b40-45fc-9346-05b4843776e4","url":"https://ot-intel-api.onrender.com/ot/agentic/threat-hunt/control-loop?observed_processes=AnyDesk&zone=OT","method":"GET","fingerprint":"689e32a02584fa21138e91d95f97876341acd2dd6930b04ff4579cddcd7ace24","name":null,"description":null,"category":"other","docs_url":null,"advertised_price_usd":"0.150000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","scheme":"exact","networks":["eip155:8453"],"pay_to":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","input_schema":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"zone":{"type":"string","description":"Asset zone: OT, IT, or DMZ. Any RMM/LOTL match on OT is always scored HIGH."},"observed_commands":{"type":"string","description":"Comma-separated command strings observed. Must not contain literal commas within a command."},"observed_processes":{"type":"string","description":"Comma-separated process/tool names observed. At least one of observed_processes or observed_commands is required."}}}},"additionalProperties":false},"output_schema":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}},"schema_completeness":0,"status":"live","first_seen_at":"2026-08-23 22:54:06.924284+00","last_seen_at":"2026-08-23 22:54:04.887+00","last_success_at":"2026-09-14 09:12:47.001+00","dead_since":null,"probe_backoff_tier":0,"next_probe_at":"2026-09-14 09:17:47.001+00","search_tsv":"","catalog_number":"8792","x402_version":2,"resource_url":"https://ot-intel-api.onrender.com/ot/agentic/threat-hunt/control-loop?observed_processes=AnyDesk&zone=OT","resource_description":"Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Pass observed_processes? and/or observed_commands? (comma-separated, max 40 combined), optional zone (OT/IT/DMZ). Fully deterministic keyword matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134). ADVISORY ONLY — never executes containment or any network action.","bazaar_extension":{"info":{"input":{"type":"http","method":"GET","queryParams":{"zone":"OT","observed_processes":"AnyDesk"}},"output":{"type":"json","example":{"zone":"OT","method":"keyword_pattern_match_v1","risk_level":"HIGH","risk_score":53,"data_sources":["caller_supplied_telemetry"],"advisory_only":true,"tokens_evaluated":1,"categories_matched":["rmm_abuse"],"matched_indicators":[{"category":"rmm_abuse","indicator":"anydesk","matched_on":"AnyDesk"}],"recommended_next_steps":["Confirm the remote-access tool is on the approved vendor-support allowlist for this asset.","Verify the session was initiated by an authorized account, not an unattended/service account."]}}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"zone":{"type":"string","description":"Asset zone: OT, IT, or DMZ. Any RMM/LOTL match on OT is always scored HIGH."},"observed_commands":{"type":"string","description":"Comma-separated command strings observed. Must not contain literal commas within a command."},"observed_processes":{"type":"string","description":"Comma-separated process/tool names observed. At least one of observed_processes or observed_commands is required."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}}},"accepted_requirements":[{"raw":{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"payTo":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","amount":"150000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":300},"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","scheme":"exact","network":"eip155:8453","amountAtomic":"150000"}],"bazaar_compatible":true,"bazaar_validated_at":"2026-09-14 09:12:47.001+00","bazaar_validation_error":null,"window":"24h","probes_n":25,"handshake_uptime":1,"settle_success_rate":0,"valid_result_rate":null,"latency_p50":491,"latency_p90":1710,"price_drift_pct":0,"score":0.796,"computed_at":"2026-09-14 09:13:19.25+00","source_metadata":[{"raw":{"url":"https://ot-intel-api.onrender.com/ot/agentic/threat-hunt/control-loop?observed_processes=AnyDesk&zone=OT","method":"GET","source":"bazaar:api.cdp.coinbase.com","fingerprint":"689e32a02584fa21138e91d95f97876341acd2dd6930b04ff4579cddcd7ace24","advertisedPriceUsd":0.15},"source_id":1,"external_id":null}],"live_endpoint_metadata":{"x402_version":2,"resource_url":"https://ot-intel-api.onrender.com/ot/agentic/threat-hunt/control-loop?observed_processes=AnyDesk&zone=OT","resource_description":"Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Pass observed_processes? and/or observed_commands? (comma-separated, max 40 combined), optional zone (OT/IT/DMZ). Fully deterministic keyword matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134). ADVISORY ONLY — never executes containment or any network action.","bazaar_extension":{"info":{"input":{"type":"http","method":"GET","queryParams":{"zone":"OT","observed_processes":"AnyDesk"}},"output":{"type":"json","example":{"zone":"OT","method":"keyword_pattern_match_v1","risk_level":"HIGH","risk_score":53,"data_sources":["caller_supplied_telemetry"],"advisory_only":true,"tokens_evaluated":1,"categories_matched":["rmm_abuse"],"matched_indicators":[{"category":"rmm_abuse","indicator":"anydesk","matched_on":"AnyDesk"}],"recommended_next_steps":["Confirm the remote-access tool is on the approved vendor-support allowlist for this asset.","Verify the session was initiated by an authorized account, not an unattended/service account."]}}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":[],"properties":{"zone":{"type":"string","description":"Asset zone: OT, IT, or DMZ. Any RMM/LOTL match on OT is always scored HIGH."},"observed_commands":{"type":"string","description":"Comma-separated command strings observed. Must not contain literal commas within a command."},"observed_processes":{"type":"string","description":"Comma-separated process/tool names observed. At least one of observed_processes or observed_commands is required."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}}},"accepted_requirements":[{"raw":{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"payTo":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","amount":"150000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":300},"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","scheme":"exact","network":"eip155:8453","amountAtomic":"150000"}],"bazaar_compatible":true,"bazaar_validated_at":"2026-09-14 09:12:47.001+00","bazaar_validation_error":null},"sonar_metrics":{"score":0.796,"uptime":1,"paid_success_rate":0,"valid_result_rate":null,"latency_p50":491,"latency_p90":1710,"price_drift_pct":0},"cdp_indexed":false,"confidence":"high"}