<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Threat Actor TTPs

## MITRE ATT&CK TAXII Server

**Base URL:** `https://cti-taxii.mitre.org/`

### List Collections
```bash
curl -H "Accept: application/taxii+json;version=2.1" \
  https://cti-taxii.mitre.org/taxii2/collections/
```

### Get Enterprise ATT&CK Objects
```bash
curl -H "Accept: application/taxii+json;version=2.1" \
  "https://cti-taxii.mitre.org/stix/collections/enterprise-attack/objects/"
```

## attackcti Python Library

```python
from attackcti import attack_client

lift = attack_client()

# All Enterprise techniques
techniques = lift.get_enterprise_techniques()

# All groups
groups = lift.get_groups()

# Techniques by group
techs = lift.get_techniques_used_by_group("G0016")

# Software used by group
software = lift.get_software_used_by_group("G0016")

# Groups using a technique
groups_using = lift.get_groups_using_technique("T1566.001")
```

## mitreattack-python Library

```python
from mitreattack.stix20 import MitreAttackData

mitre = MitreAttackData("enterprise-attack.json")

# Get technique by ID
tech = mitre.get_object_by_attack_id("T1566.001", "attack-pattern")

# Get group by ID
group = mitre.get_object_by_attack_id("G0016", "intrusion-set")

# Get techniques used by group
techs = mitre.get_techniques_used_by_group(group["id"])
```

## ATT&CK Navigator Layer Schema

```json
{
  "name": "Layer Name",
  "versions": {"attack": "16.1", "navigator": "5.1.0", "layer": "4.5"},
  "domain": "enterprise-attack",
  "techniques": [
    {
      "techniqueID": "T1566.001",
      "tactic": "initial-access",
      "color": "#ff6666",
      "score": 100,
      "comment": "Observed in campaign X",
      "enabled": true
    }
  ],
  "gradient": {"colors": ["#ffffff", "#ff6666"], "minValue": 0, "maxValue": 100}
}
```

**Import:** ATT&CK Navigator → Open Existing Layer → Upload from local

## Key Group IDs

| Group | ATT&CK ID | Aliases |
|-------|-----------|---------|
| APT28 | G0007 | Fancy Bear, Strontium, Sofacy |
| APT29 | G0016 | Cozy Bear, Midnight Blizzard, Nobelium |
| Lazarus | G0032 | HIDDEN COBRA, Zinc |
| FIN7 | G0046 | Carbanak, Navigator Group |
| Sandworm | G0034 | Voodoo Bear, IRIDIUM |
| Scattered Spider | G1015 | UNC3944, Muddled Libra |
