<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Intelligence Lifecycle Management

## PIR Schema

```json
{
  "pir_id": "PIR-20260101",
  "question": "Which APT groups are actively targeting the finance sector?",
  "priority": "HIGH",
  "stakeholder": "CISO",
  "collection_sources": ["isac-feeds", "vendor-reports", "dark-web"],
  "update_cadence": "monthly",
  "dissemination_tlp": "TLP:AMBER",
  "status": "active"
}
```

## Intelligence Product Schema

```json
{
  "title": "Q1 2026 Threat Landscape Brief",
  "type": "strategic",
  "tlp": "TLP:AMBER",
  "confidence": "HIGH",
  "produced": "2026-03-15T00:00:00Z",
  "key_findings": ["Finding 1", "Finding 2"],
  "recommendations": ["Recommendation 1"],
  "pirs_addressed": ["PIR-001", "PIR-003"],
  "key_assumptions": ["Assumption 1"],
  "limitations": ["Limitation 1"]
}
```

## TLP Marking Reference

| Marking | API Value | Sharing Scope |
|---------|-----------|--------------|
| TLP:CLEAR | `TLP:CLEAR` | Public / unrestricted |
| TLP:GREEN | `TLP:GREEN` | Community |
| TLP:AMBER | `TLP:AMBER` | Organization + need-to-know partners |
| TLP:AMBER+STRICT | `TLP:AMBER+STRICT` | Organization only |
| TLP:RED | `TLP:RED` | Named recipients only |

## MISP Event for Intelligence Products

### Create Event (Strategic Brief)
```bash
curl -X POST "$MISP_URL/events/add" \
  -H "Authorization: $MISP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "Event": {
      "info": "Q1 2026 Threat Landscape Brief",
      "distribution": 1,
      "threat_level_id": 2,
      "analysis": 2,
      "Tag": [
        {"name": "tlp:amber"},
        {"name": "type:intelligence-report"}
      ]
    }
  }'
```

## OpenCTI Report Creation

```graphql
mutation {
  reportAdd(input: {
    name: "Q1 2026 Threat Landscape Brief"
    description: "Strategic assessment of threat landscape"
    published: "2026-03-15T00:00:00Z"
    report_types: ["threat-report"]
    confidence: 85
    objectMarking: ["TLP:AMBER marking ID"]
  }) {
    id
    name
  }
}
```

## Program Metrics KPIs

| Metric | Target | Measurement |
|--------|--------|-------------|
| PIR Coverage | >80% | PIRs answered / total PIRs |
| Time to Produce | <24h tactical, <7d strategic | Requirement to product |
| Stakeholder Satisfaction | >75% | Survey positive responses |
| Detection Coverage | >60% | Actor techniques with rules |
| Feed Health | >95% uptime | Feed availability monitoring |
| IOC Age Compliance | <7d avg for IPs | Average active IOC age |

## Dissemination Channels

| Channel | Product Type | Format |
|---------|-------------|--------|
| Email (encrypted) | Strategic briefs | PDF with TLP header |
| MISP Event | Tactical IOCs | STIX/JSON attributes |
| Slack/Teams | Alerts | Short-form notification |
| Wiki/Confluence | Reports | Full HTML/markdown |
| SIEM Push | Detection rules | Sigma/SPL/KQL |
