<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security Event Enrichment — API Reference

## MaxMind GeoIP2 Python

```python
import geoip2.database

reader = geoip2.database.Reader("/usr/share/GeoIP/GeoLite2-City.mmdb")
resp = reader.city("185.220.101.1")
print(resp.country.iso_code)     # "DE"
print(resp.city.name)            # "Frankfurt"
print(resp.location.latitude)    # 50.1109
print(resp.location.longitude)   # 8.6821
reader.close()
```

## Splunk REST API — Event Enrichment

```python
import requests

SPLUNK_URL = "https://splunk.corp.local:8089"
SPLUNK_TOKEN = "Bearer your-token"

# Search for events and apply lookup enrichment
resp = requests.post(f"{SPLUNK_URL}/services/search/jobs", headers={
    "Authorization": SPLUNK_TOKEN,
}, data={
    "search": '| search index=security src_ip=* | lookup threat_intel_lookup ip AS src_ip OUTPUT threat_score tags',
    "output_mode": "json",
})
```

## Elasticsearch Enrich Policy

```json
PUT /_enrich/policy/geoip-policy
{
    "match": {
        "indices": "geoip-data",
        "match_field": "ip",
        "enrich_fields": ["country", "city", "asn", "org"]
    }
}

POST /_enrich/policy/geoip-policy/_execute
```

## AbuseIPDB Check API

```python
resp = requests.get("https://api.abuseipdb.com/api/v2/check", headers={
    "Key": "your-key", "Accept": "application/json",
}, params={"ipAddress": "185.220.101.1", "maxAgeInDays": 90, "verbose": True})
```

## Enrichment Pipeline Pattern

```
raw_event → geoip_enricher → ti_enricher → asset_enricher → user_enricher → severity_scorer → enriched_event
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Enrichment completed successfully |
| 1 | Partial enrichment — some sources unavailable |
| 2 | Pipeline failure |
