<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Campaign Tracking

## OpenCTI Campaign API

### Create Campaign
```python
from pycti import OpenCTIApiClient
api = OpenCTIApiClient(url="http://localhost:8080", token="TOKEN")

campaign = api.campaign.create(
    name="Operation Alpha",
    description="Targeted campaign against energy sector",
    first_seen="2026-01-15T00:00:00Z",
    last_seen="2026-03-01T00:00:00Z",
)
```

### Link Campaign to Actor
```python
api.stix_core_relationship.create(
    fromId=campaign["id"],
    toId=threat_actor_id,
    relationship_type="attributed-to",
)
```

## MISP Campaign Events

### Create Campaign Event
```bash
curl -X POST -H "Authorization: MISP_KEY" \
  -H "Content-Type: application/json" \
  https://misp.local/events \
  -d '{"Event":{"info":"Campaign Alpha - Phase 1","distribution":1,"Tag":[{"name":"campaign:alpha"}]}}'
```

## STIX 2.1 Campaign Object

```json
{
  "type": "campaign",
  "spec_version": "2.1",
  "name": "Operation Alpha",
  "description": "Targeted campaign",
  "first_seen": "2026-01-15T00:00:00Z",
  "last_seen": "2026-03-01T00:00:00Z",
  "aliases": ["Project X"]
}
```

## Diamond Model Mapping

| Vertex | STIX Object | Key Fields |
|--------|------------|------------|
| Adversary | intrusion-set, threat-actor | name, aliases, motivation |
| Capability | malware, tool, attack-pattern | name, type, kill_chain_phases |
| Infrastructure | infrastructure, ipv4-addr, domain-name | value, first/last_seen |
| Victim | identity | name, sectors, contact_information |
