<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Threat Intelligence Correlation — API Reference

## CISA KEV API

```bash
# Download full KEV catalog
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" -o kev.json

# Query specific CVE
jq '.vulnerabilities[] | select(.cveID=="CVE-2024-6387")' kev.json

# List by due date
jq '[.vulnerabilities[] | select(.dueDate >= "2026-03-01")] | sort_by(.dueDate)' kev.json
```

## AlienVault OTX API

```bash
# CVE general info (pulse count, references)
curl -s "https://otx.alienvault.com/api/v1/indicators/cve/CVE-2024-6387/general" \
  -H "X-OTX-API-KEY: $OTX_KEY"

# Related malware samples
curl -s "https://otx.alienvault.com/api/v1/indicators/cve/CVE-2024-6387/malware" \
  -H "X-OTX-API-KEY: $OTX_KEY"

# Search pulses
curl -s "https://otx.alienvault.com/api/v1/search/pulses?q=CVE-2024-6387" \
  -H "X-OTX-API-KEY: $OTX_KEY"

# Get pulse details
curl -s "https://otx.alienvault.com/api/v1/pulses/PULSE_ID" \
  -H "X-OTX-API-KEY: $OTX_KEY"
```

## VirusTotal API

```bash
# Search for CVE-related files
curl -s "https://www.virustotal.com/api/v3/intelligence/search?query=tag:cve-2024-6387" \
  -H "x-apikey: $VT_KEY"

# Get file behavior report
curl -s "https://www.virustotal.com/api/v3/files/HASH/behaviour_summary" \
  -H "x-apikey: $VT_KEY"
```

## MISP API

```bash
# Search events by CVE attribute
curl -s -X POST "https://misp.internal/events/restSearch" \
  -H "Authorization: $MISP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"value": "CVE-2024-6387", "type": "vulnerability"}'

# Get event with IOCs
curl -s "https://misp.internal/events/view/EVENT_ID" \
  -H "Authorization: $MISP_KEY"
```

## Exploit Maturity Levels

| Level | Description | TI Signal |
|-------|-------------|-----------|
| None | No known exploit code | No OTX pulses, no PoC |
| PoC | Proof of concept exists | GitHub repos, limited pulses |
| Weaponized | Exploit integrated into tools | Multiple pulses, Metasploit module |
| Active | In-the-wild exploitation confirmed | KEV listed, high pulse count |
