<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Threat Landscape Mapping

## Shodan API

### Search
```bash
curl "https://api.shodan.io/shodan/host/search?key=KEY&query=org:Example+Corp"
```

### Host Info
```bash
curl "https://api.shodan.io/shodan/host/IP?key=KEY"
```

## Censys Search API

**Base URL:** `https://search.censys.io/api/v2/`

### Host Search
```bash
curl -u API_ID:API_SECRET \
  "https://search.censys.io/api/v2/hosts/search?q=services.software.product:Apache&per_page=25"
```

## ATT&CK Group Query

```python
from attackcti import attack_client
lift = attack_client()

# All groups
groups = lift.get_groups()

# Techniques by group
techs = lift.get_techniques_used_by_group("G0007")

# Software by group
software = lift.get_software_used_by_group("G0007")
```

## ENISA Threat Landscape (Reference)

Annual report covering:
- Top threats by sector
- Threat actor trends
- Attack technique evolution
- Sector-specific risk assessments

## Threat Matrix Template

| Factor | Weight | Score Range |
|--------|--------|------------|
| Targeting fit | 30% | 0-100 |
| Capability level | 25% | 0-100 |
| Active campaigns | 20% | 0/100 |
| Technology overlap | 15% | 0-100 |
| Historical incidents | 10% | 0-100 |
