{"id":"2c8589b4-8542-41a1-b346-f33cf4669c8e","url":"https://ot-intel-api.onrender.com/ot/precursor-ttp?actor=SANDWORM","method":"GET","fingerprint":"f662de78348a711d49de1f811fa6a240cfae70856913947da993218c9b23d581","name":null,"description":null,"category":"other","docs_url":null,"advertised_price_usd":"0.040000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","scheme":"exact","networks":["eip155:8453"],"pay_to":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","input_schema":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["actor"],"properties":{"actor":{"type":"string","description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"}}}},"additionalProperties":false},"output_schema":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}},"schema_completeness":0,"status":"live","first_seen_at":"2026-08-23 22:54:04.151406+00","last_seen_at":"2026-08-23 22:54:02.281+00","last_success_at":"2026-10-15 11:34:05.977+00","dead_since":null,"probe_backoff_tier":0,"next_probe_at":"2026-10-15 11:39:05.977+00","search_tsv":"","catalog_number":"8770","x402_version":2,"resource_url":"https://ot-intel-api.onrender.com/ot/precursor-ttp?actor=SANDWORM","resource_description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup against intel.db. Not LLM-generated.","bazaar_extension":{"info":{"input":{"type":"http","method":"GET","queryParams":{"actor":"SANDWORM"}},"output":{"type":"json","example":{"actor":"SANDWORM","pre_impact":{"count":9,"ratio":0.64,"techniques":[{"tactic":"discovery","technique_id":"T0846","technique_name":"Remote System Discovery"}]},"total_ttps":14,"_methodology":"Deterministic bucketing of ATT&CK-for-ICS tactics: pre_impact = initial_access, execution, persistence, privilege_escalation, evasion, discovery, lateral_movement, collection, command_and_control. impact_stage = inhibit_response_function, impair_process_control, impact. No LLM in the classification path.","data_sources":["OT-Intel-DB"],"impact_stage":{"count":3,"ratio":0.21,"techniques":[{"tactic":"impair_process_control","technique_id":"T0836","technique_name":"Modify Parameter"}]},"unclassified":{"count":2,"ratio":0.14,"techniques":[]},"early_warning_assessment":"9 of 14 known TTPs for SANDWORM are pre-impact stage (reconnaissance through command-and-control) — this actor typically presents an early-warning window before physical/process disruption, consistent with dwell-time behavior documented in ICS threat research."}}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["actor"],"properties":{"actor":{"type":"string","description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}}},"accepted_requirements":[{"raw":{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"payTo":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","amount":"40000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":300},"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","scheme":"exact","network":"eip155:8453","amountAtomic":"40000"}],"bazaar_compatible":true,"bazaar_validated_at":"2026-10-15 11:34:05.977+00","bazaar_validation_error":null,"window":"24h","probes_n":11,"handshake_uptime":1,"settle_success_rate":0,"valid_result_rate":null,"latency_p50":628,"latency_p90":970,"price_drift_pct":0,"score":0.8348,"computed_at":"2026-10-15 11:34:16.06+00","source_metadata":[{"raw":{"url":"https://ot-intel-api.onrender.com/ot/precursor-ttp?actor=SANDWORM","method":"GET","source":"bazaar:api.cdp.coinbase.com","fingerprint":"f662de78348a711d49de1f811fa6a240cfae70856913947da993218c9b23d581","advertisedPriceUsd":0.04},"source_id":1,"external_id":null}],"live_endpoint_metadata":{"x402_version":2,"resource_url":"https://ot-intel-api.onrender.com/ot/precursor-ttp?actor=SANDWORM","resource_description":"Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-response-function, impair-process-control, impact). Deterministic tactic-taxonomy lookup against intel.db. Not LLM-generated.","bazaar_extension":{"info":{"input":{"type":"http","method":"GET","queryParams":{"actor":"SANDWORM"}},"output":{"type":"json","example":{"actor":"SANDWORM","pre_impact":{"count":9,"ratio":0.64,"techniques":[{"tactic":"discovery","technique_id":"T0846","technique_name":"Remote System Discovery"}]},"total_ttps":14,"_methodology":"Deterministic bucketing of ATT&CK-for-ICS tactics: pre_impact = initial_access, execution, persistence, privilege_escalation, evasion, discovery, lateral_movement, collection, command_and_control. impact_stage = inhibit_response_function, impair_process_control, impact. No LLM in the classification path.","data_sources":["OT-Intel-DB"],"impact_stage":{"count":3,"ratio":0.21,"techniques":[{"tactic":"impair_process_control","technique_id":"T0836","technique_name":"Modify Parameter"}]},"unclassified":{"count":2,"ratio":0.14,"techniques":[]},"early_warning_assessment":"9 of 14 known TTPs for SANDWORM are pre-impact stage (reconnaissance through command-and-control) — this actor typically presents an early-warning window before physical/process disruption, consistent with dwell-time behavior documented in ICS threat research."}}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["actor"],"properties":{"actor":{"type":"string","description":"ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}}},"accepted_requirements":[{"raw":{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"payTo":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","amount":"40000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":300},"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","payTo":"0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B","scheme":"exact","network":"eip155:8453","amountAtomic":"40000"}],"bazaar_compatible":true,"bazaar_validated_at":"2026-10-15 11:34:05.977+00","bazaar_validation_error":null},"sonar_metrics":{"score":0.8348,"uptime":1,"paid_success_rate":0,"valid_result_rate":null,"latency_p50":628,"latency_p90":970,"price_drift_pct":0},"cdp_indexed":false,"confidence":"medium"}