<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Geopolitical Threat Analysis

## MITRE ATT&CK Group Lookup

### All Groups
```bash
curl -H "Accept: application/taxii+json;version=2.1" \
  "https://cti-taxii.mitre.org/stix/collections/enterprise-attack/objects/?match[type]=intrusion-set"
```

## CISA Advisories

### Recent Advisories (RSS)
```bash
curl https://www.cisa.gov/cybersecurity-advisories/all.xml | xmllint --xpath '//item/title/text()' -
```

## Recorded Future API

**Base URL:** `https://api.recordedfuture.com/v2/`

### Search Threat Actors
```bash
curl -H "X-RFToken: TOKEN" \
  "https://api.recordedfuture.com/v2/entity/search?entity_type=ThreatActor&freetext=Russia"
```

### Get Entity Details
```bash
curl -H "X-RFToken: TOKEN" \
  "https://api.recordedfuture.com/v2/entity/ENTITY_ID"
```

## Open-Source Geopolitical Feeds

| Source | URL | Format |
|--------|-----|--------|
| CISA Advisories | cisa.gov/cybersecurity-advisories | RSS/XML |
| CFR Cyber Ops | cfr.org/cyber-operations | Web |
| IISS Conflict Map | iiss.org/publications | Web |

## Nation-State Actor Quick Reference

| State | Key Groups (ATT&CK) | Primary TTPs |
|-------|---------------------|--------------|
| Russia | G0007, G0016, G0034 | T1566, T1195, T1486 |
| China | G0006, G0045, G0096 | T1190, T1059, T1005 |
| Iran | G0064, G0059, G0069 | T1078, T1486, T1498 |
| DPRK | G0032, G0086, G0138 | T1566, T1204, T1486 |
