SERVICE / DETAILother

Unnamed service

GET ot-intel-api.onrender.com/ot/agentic/threat-hunt/control-loop

OPEN SERVICE ↗
SONAR SCORE0.796
LIVE PRICE0.150000
BAZAAR LIVEcompatible
CDP INDEXEDno
DECISION EVIDENCE

Why an agent can trust this route.

25 observations in the last 24h
HANDSHAKE SUCCESS100.0%402 challenge reachable
PAID DELIVERY0.0%settlement observed
P90 LATENCY1710msrecent response window
PRICE DRIFT0.0%advertised vs observed

Sonar evidence is advisory. Paid delivery is shown as verified only when paid probes are available; otherwise route estimates use the unpaid handshake as a clearly labeled proxy.

SONAR PROBE HISTORY / 30D

Observed outcomes

JSON ↗
LIVE ENDPOINT METADATA

Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Pass observed_processes? and/or observed_commands? (comma-separated, max 40 combined), optional zone (OT/IT/DMZ). Fully deterministic keyword matching, no LLM. Grounded in CyberAgentX and AgenticCyOps (arXiv 2603.09134). ADVISORY ONLY — never executes containment or any network action.

Resource: ot-intel-api.onrender.com/ot/agentic/threat-hunt/control-loop

Network: eip155:8453 · Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 · Pay to: 0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B

Payment methods: — · Last validation: 2026-09-14 09:12:47.001+00

{
  "input": {
    "type": "object",
    "required": [
      "type",
      "method"
    ],
    "properties": {
      "type": {
        "type": "string",
        "const": "http"
      },
      "method": {
        "enum": [
          "GET"
        ],
        "type": "string"
      },
      "queryParams": {
        "type": "object",
        "required": [],
        "properties": {
          "zone": {
            "type": "string",
            "description": "Asset zone: OT, IT, or DMZ. Any RMM/LOTL match on OT is always scored HIGH."
          },
          "observed_commands": {
            "type": "string",
            "description": "Comma-separated command strings observed. Must not contain literal commas within a command."
          },
          "observed_processes": {
            "type": "string",
            "description": "Comma-separated process/tool names observed. At least one of observed_processes or observed_commands is required."
          }
        }
      }
    },
    "additionalProperties": false
  },
  "output": {
    "type": "object",
    "required": [
      "type"
    ],
    "properties": {
      "type": {
        "type": "string"
      },
      "example": {
        "type": "object"
      }
    }
  },
  "paymentRequirements": [
    {
      "raw": {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "150000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      },
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
      "scheme": "exact",
      "network": "eip155:8453",
      "amountAtomic": "150000"
    }
  ]
}
METADATA PROVENANCE

Source catalog records are retained separately from live endpoint observations. Sonar score, uptime, and latency are advisory metrics. CDP indexing is not inferred from validation.