Unnamed service

Deterministic STIX representability + actionability lookup, grounded in Hahn/Krief et al. (arXiv:2512.18714v3, Jan 2026). Pass technique_id (MITRE ATT&CK ICS ID, optionally campaign=Triton|Stuxnet|Industroyer), protocol, or cve_id. Returns whether STIX 2.1 can represent the artifact (full/partial/none) and whether reporting gave enough detail to build a detection. Answers what STIX sharing alone can't tell you: is this actually actionable once shared. No LLM in the lookup path.

Resource: ot-intel-api.onrender.com/ot/stix-coverage

Network: eip155:8453 · Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 · Pay to: 0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B

Payment methods: — · Last validation: 2026-09-14 12:05:29.083+00

{
  "input": {
    "type": "object",
    "required": [
      "type",
      "method"
    ],
    "properties": {
      "type": {
        "type": "string",
        "const": "http"
      },
      "method": {
        "enum": [
          "GET"
        ],
        "type": "string"
      },
      "queryParams": {
        "type": "object",
        "required": [],
        "properties": {
          "cve_id": {
            "type": "string",
            "description": "CVE ID from the paper's 8-row CISA KEV table, e.g. CVE-2023-3595. At least one of technique_id, protocol, or cve_id is required."
          },
          "campaign": {
            "type": "string",
            "description": "Optional filter: Triton, Stuxnet, or Industroyer — narrows a technique_id lookup to one case study."
          },
          "protocol": {
            "type": "string",
            "description": "ICS protocol name, e.g. TriStation, S7Comm, IEC 61850 MMS, CIP. At least one of technique_id, protocol, or cve_id is required."
          },
          "technique_id": {
            "type": "string",
            "description": "MITRE ATT&CK ICS technique ID, e.g. T0836. At least one of technique_id, protocol, or cve_id is required."
          }
        }
      }
    },
    "additionalProperties": false
  },
  "output": {
    "type": "object",
    "required": [
      "type"
    ],
    "properties": {
      "type": {
        "type": "string"
      },
      "example": {
        "type": "object"
      }
    }
  },
  "paymentRequirements": [
    {
      "raw": {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
        "amount": "200000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      },
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
      "scheme": "exact",
      "network": "eip155:8453",
      "amountAtomic": "200000"
    }
  ]
}

Source catalog records are retained separately from live endpoint observations. Sonar score, uptime, and latency are advisory metrics. CDP indexing is not inferred from validation.