<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Threat Feed Processing — API Reference

## TAXII 2.0 Client

```python
from taxii2client.v20 import Server, Collection

# Discover collections
server = Server("https://taxii.example.com/taxii/", user="user", password="pass")
api_root = server.api_roots[0]
for collection in api_root.collections:
    print(collection.title, collection.id)

# Fetch indicators
collection = Collection(f"https://taxii.example.com/collections/{coll_id}/")
bundle = collection.get_objects()
for obj in bundle["objects"]:
    if obj["type"] == "indicator":
        print(obj["pattern"])
```

## STIX 2.1 Objects

```python
from stix2 import Indicator, Bundle

# Create indicator
indicator = Indicator(
    name="Malicious IP",
    pattern="[ipv4-addr:value = '1.2.3.4']",
    pattern_type="stix",
    valid_from="2024-01-01T00:00:00Z",
)

# Bundle
bundle = Bundle(objects=[indicator])
print(bundle.serialize(pretty=True))
```

## MISP API

```bash
# Search events
curl -H "Authorization: $MISP_KEY" -H "Content-Type: application/json" \
  "https://misp.local/events/restSearch" -d '{"returnFormat":"json","limit":10}'

# Get attributes by type
curl -H "Authorization: $MISP_KEY" \
  "https://misp.local/attributes/restSearch" -d '{"type":"ip-dst","limit":100}'

# Add attribute
curl -X POST -H "Authorization: $MISP_KEY" \
  "https://misp.local/attributes/add/{event_id}" \
  -d '{"type":"ip-dst","value":"1.2.3.4","to_ids":true}'
```

## AlienVault OTX API

```bash
# Get pulse indicators
curl -H "X-OTX-API-KEY: $OTX_KEY" \
  "https://otx.alienvault.com/api/v1/pulses/subscribed?limit=10"

# IP reputation
curl -H "X-OTX-API-KEY: $OTX_KEY" \
  "https://otx.alienvault.com/api/v1/indicators/IPv4/1.2.3.4/general"
```

## IOC Pattern Reference

| Type | Regex Pattern |
|------|--------------|
| IPv4 | `\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b` |
| MD5 | `\b([a-fA-F0-9]{32})\b` |
| SHA256 | `\b([a-fA-F0-9]{64})\b` |
| URL | `(https?://[^\s<>"']+)` |
| Email | `[\w.+-]+@[\w-]+\.[\w.-]+` |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Feed processed successfully |
| 1 | Empty feed or no IOCs extracted |
| 2 | Runtime error or API failure |
