<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Incident Enrichment Tools — API Reference

## AbuseIPDB API

```bash
# Check IP reputation
curl -G "https://api.abuseipdb.com/api/v2/check" \
  -H "Key: $ABUSEIPDB_KEY" -H "Accept: application/json" \
  -d "ipAddress=1.2.3.4" -d "maxAgeInDays=90"

# Report IP
curl -X POST "https://api.abuseipdb.com/api/v2/report" \
  -H "Key: $ABUSEIPDB_KEY" \
  -d "ip=1.2.3.4" -d "categories=18,22" -d "comment=SSH brute force"
```

## VirusTotal API v3

```bash
# IP report
curl "https://www.virustotal.com/api/v3/ip_addresses/1.2.3.4" -H "x-apikey: $VT_KEY"

# Domain report
curl "https://www.virustotal.com/api/v3/domains/example.com" -H "x-apikey: $VT_KEY"

# File hash report
curl "https://www.virustotal.com/api/v3/files/{sha256}" -H "x-apikey: $VT_KEY"
```

## Shodan API

```bash
# Host lookup
curl "https://api.shodan.io/shodan/host/1.2.3.4?key=$SHODAN_KEY"

# Search
curl "https://api.shodan.io/shodan/host/search?key=$SHODAN_KEY&query=apache"
```

## RDAP (WHOIS replacement)

```bash
# Domain RDAP
curl "https://rdap.org/domain/example.com"

# IP RDAP
curl "https://rdap.org/ip/1.2.3.4"

# ASN RDAP
curl "https://rdap.org/autnum/15169"
```

## MaxMind GeoIP

```python
import geoip2.database

reader = geoip2.database.Reader("/usr/share/GeoIP/GeoLite2-City.mmdb")
response = reader.city("1.2.3.4")
print(response.country.iso_code)    # 'US'
print(response.city.name)           # 'Mountain View'
print(response.location.latitude)   # 37.386
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Enrichment completed, IOC benign/unknown |
| 1 | IOC flagged as malicious by one or more sources |
| 2 | API error or missing credentials |
