{
  "x402Version": 2,
  "id": 8948,
  "slug": "8948",
  "resource": "https://ot-intel-api.onrender.com/ot/detection",
  "description": "ICS detection artifact retrieval. Pass ?target=PIPEDREAM or ?target=SANDWORM&format=sigma. Returns YARA/Sigma rules for the target malware or actor, sourced from public corpus (Florian Roth signature-base, CISA advisories) with validated:true, or DeepSeek-synthesised with validated:false. Designed for automated threat hunting pipelines that commit rules to SIEMs and EDRs — validated:true rules are safe to deploy; validated:false require lab testing first.",
  "type": "http",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x1888192FAc6a69e4cd7d078eC4bCf6F24f7C767B",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "50000",
      "maxTimeoutSeconds": 300
    }
  ],
  "outputSchema": {
    "bazaar": {
      "info": {
        "input": {
          "method": "GET",
          "queryParams": {
            "target": "PIPEDREAM"
          },
          "type": "http"
        },
        "output": {
          "example": {
            "artifact_type": "malware",
            "data_sources": [
              "OT-Intel-DB",
              "DeepSeek-CTI-Analysis"
            ],
            "freshness": "2026-06-19T10:00:00Z",
            "ot_safe_validation": "0 of 1 rules sourced from public corpus. Rules with validated:false require lab testing before production deployment.",
            "signatures": [
              {
                "ot_safe_note": "Synthesised from CISA advisory AA22-103A. Test against OT baseline before SIEM deployment.",
                "raw_rule": "rule PIPEDREAM_INCONTROLLER_Loader { meta: ... strings: ... condition: ... }",
                "rule_name": "PIPEDREAM_INCONTROLLER_Loader",
                "source": "manual",
                "target_layer": "engineering_workstation",
                "type": "YARA",
                "validated": false
              }
            ],
            "synthesised_count": 1,
            "target": "PIPEDREAM",
            "validated_count": 0
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "method": {
                "enum": [
                  "GET"
                ],
                "type": "string"
              },
              "queryParams": {
                "properties": {
                  "format": {
                    "description": "Rule format: yara | sigma | snort | all (default: all)",
                    "type": "string"
                  },
                  "target": {
                    "description": "Malware or actor name e.g. PIPEDREAM, INDUSTROYER2, TRITON, SANDWORM, CHERNOVITE",
                    "type": "string"
                  }
                },
                "required": [
                  "target"
                ],
                "type": "object"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method"
            ],
            "type": "object"
          },
          "output": {
            "properties": {
              "example": {
                "type": "object"
              },
              "type": {
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "bazaar"
  ],
  "sourceHost": "ot-intel-api.onrender.com",
  "lastUpdated": "2026-08-25T12:50:40.912Z",
  "quality": {
    "calls30d": 1,
    "uniquePayers30d": 1,
    "lastCalledAt": "2026-08-25T12:50:40.489Z"
  },
  "liveness": {},
  "verified": false,
  "featured": false,
  "provider": {
    "host": "ot-intel-api.onrender.com",
    "manifest_name": "ot-intel-api.onrender.com",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-09-18T22:00:31.484Z"
  }
}