<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Threat-Informed Defense

## MITRE ATT&CK STIX API

### Endpoints

| Resource | URL |
|---|---|
| Enterprise ATT&CK | `https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json` |
| Groups | Filter STIX objects by `type: intrusion-set` |
| Techniques | Filter STIX objects by `type: attack-pattern` |
| Relationships | Filter by `type: relationship` for group-to-technique mappings |

### mitreattack-python

| Class | Method | Description |
|---|---|---|
| `MitreAttackData` | `get_groups()` | List all threat groups |
| `MitreAttackData` | `get_techniques_by_group(group_id)` | Techniques used by group |
| `MitreAttackData` | `get_all_techniques()` | List all techniques |

## ATT&CK Navigator Layer Schema

| Field | Type | Description |
|---|---|---|
| `name` | string | Layer display name |
| `domain` | string | `enterprise-attack` |
| `techniques[].techniqueID` | string | ATT&CK technique ID |
| `techniques[].color` | string | Hex color |
| `techniques[].score` | int | 0-100 score |
| `techniques[].comment` | string | Note text |

## Agent Script

```bash
# Identify threats for sector
node agent.js identify-threats --sector financial-services \
  --geography north-america --output threat_profile.yaml

# Run gap analysis
node agent.js gap-analysis --threat-profile threat_profile.yaml \
  --detection-rules rules/ --output gaps.json

# Prioritize defenses
node agent.js prioritize --gaps gaps.json --output priorities.json

# Generate ATT&CK Navigator heatmap
node agent.js generate-heatmap --threat-profile threat_profile.yaml \
  --coverage-data gaps.json --output layer.json

# Track improvement
node agent.js track-progress --baseline baseline.json --current current.json
```
