<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing ICS Patch Management — API & Tool Reference

> Quick reference for tools, commands, and APIs used in implementing-ics-patch-management.

## Tools

### `claroty-api`

ICS asset management platform

**Usage:**
```bash
curl -H 'Auth: Bearer $TOKEN' https://claroty.local/api/v1/assets
```

**Key Flags:**
  - /api/v1/assets: list assets
  - /api/v1/vulnerabilities: per-asset

---

### `cisa-kev`

CISA KEV catalog

**Usage:**
```bash
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
```

**Key Flags:**
  - JSON feed of exploited CVEs

---

### `ansible`

OT patch automation

**Usage:**
```bash
ansible-playbook -i ot_inv patch.yml --check
```

**Key Flags:**
  - --check: dry-run

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Never execute write operations against production ICS without explicit authorization

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82: Guide to OT Security
