<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — STIX/TAXII Feeds

## TAXII 2.1 Endpoints

### Discovery
```bash
curl -H "Accept: application/taxii+json;version=2.1" \
  https://cti-taxii.mitre.org/taxii2/
```

### API Roots
```bash
curl -H "Accept: application/taxii+json;version=2.1" \
  https://cti-taxii.mitre.org/stix/
```

### List Collections
```bash
curl -H "Accept: application/taxii+json;version=2.1" \
  https://cti-taxii.mitre.org/stix/collections/
```

### Get Objects (with filtering)
```bash
# All objects
curl "https://server/api/v21/collections/{id}/objects/"

# Filter by type
curl "https://server/api/v21/collections/{id}/objects/?match[type]=indicator"

# Filter by added_after
curl "https://server/api/v21/collections/{id}/objects/?added_after=2026-01-01T00:00:00Z"
```

## STIX 2.1 Pattern Examples

### Network Indicators
```
[domain-name:value = 'evil.com']
[ipv4-addr:value = '1.2.3.4']
[url:value = 'https://evil.com/payload']
[domain-name:value = 'evil.com'] AND [network-traffic:dst_port = 443]
```

### File Indicators
```
[file:hashes.'SHA-256' = 'abc123...']
[file:name = 'payload.exe']
[file:hashes.MD5 = 'abc123' OR file:hashes.'SHA-1' = 'def456']
```

### Process Indicators
```
[process:name = 'powershell.exe' AND process:command_line LIKE '%encodedcommand%']
```

## stix2 Python Library

### Create Objects
```python
import stix2

# Indicator
ind = stix2.Indicator(
    name="Evil Domain",
    pattern="[domain-name:value='evil.com']",
    pattern_type="stix",
    valid_from="2026-01-01T00:00:00Z",
)

# Malware
mal = stix2.Malware(name="SUNBURST", malware_types=["backdoor"], is_family=False)

# Relationship
rel = stix2.Relationship(relationship_type="indicates", source_ref=ind.id, target_ref=mal.id)

# Bundle
bundle = stix2.Bundle(objects=[ind, mal, rel])
```

### Parse and Validate
```python
bundle = stix2.parse(open("bundle.json").read())
for obj in bundle.objects:
    print(f"{obj.type}: {getattr(obj, 'name', obj.id)}")
```

## MITRE ATT&CK TAXII Collections

| Collection | ID |
|-----------|-----|
| Enterprise ATT&CK | `95ecc380-afe9-11e4-9b6c-751b66dd541e` |
| Mobile ATT&CK | `2f669986-b40b-4423-b720-4396ca6a462b` |
| ICS ATT&CK | `02c3ef24-9cd4-48f3-a99f-b74ce24f1d34` |

## OpenCTI GraphQL Import

```graphql
mutation($bundle: String!) {
  stixBundleImport(bundle: $bundle)
}
```

```bash
curl -X POST "$OPENCTI_URL/graphql" \
  -H "Authorization: Bearer $OPENCTI_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query":"mutation($b:String!){stixBundleImport(bundle:$b)}","variables":{"b":"..."}}'
```
