<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Diamond Model Analysis

## Diamond Model Core Structure

### Event Schema
```json
{
  "id": "event-20260101120000",
  "adversary": "APT29",
  "capability": {
    "malware": "SUNBURST",
    "techniques": ["T1195.002", "T1071.001"]
  },
  "infrastructure": {
    "domains": ["avsvmcloud.com"],
    "ips": ["13.59.205.66"],
    "type": "compromised-supply-chain"
  },
  "victim": {
    "org": "Target Corp",
    "sector": "government",
    "geo": "US"
  },
  "meta_features": {
    "timestamp": "2020-03-01T00:00:00Z",
    "phase": "initial-access",
    "confidence": "HIGH"
  }
}
```

## Pivot Techniques

### Infrastructure Pivoting via Passive DNS
```bash
# SecurityTrails API
curl -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/domain/evil.com/subdomains"

# DNSDB (Farsight)
curl -H "X-API-Key: $DNSDB_KEY" \
  "https://api.dnsdb.info/dnsdb/v2/lookup/rrset/name/evil.com"
```

### Infrastructure Pivoting via Certificate Transparency
```bash
# crt.sh
curl "https://crt.sh/?q=%.evil.com&output=json"
```

### Infrastructure via WHOIS History
```bash
# SecurityTrails WHOIS
curl -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/domain/evil.com/whois"
```

## Capability Analysis

### VirusTotal File Behavior
```bash
curl -H "x-apikey: $VT_KEY" \
  "https://www.virustotal.com/api/v3/files/{hash}/behaviour_summary"
```

### MITRE ATT&CK Technique Lookup
```python
from attackcti import attack_client
lift = attack_client()
technique = lift.get_techniques_by_id("T1195.002")
```

## Victim Enrichment

### Sector classification (NAICS codes)
- Government: 92
- Finance: 52
- Healthcare: 62
- Technology: 51
- Energy: 22
- Defense: 928

## Activity Thread Graph (NetworkX)

```python
import networkx as nx

G = nx.Graph()
G.add_node("event-1", adversary="APT29")
G.add_node("event-2", adversary="APT29")
G.add_edge("event-1", "event-2", link_type="shared_infrastructure", shared=["evil.com"])

# Find connected components (activity threads)
threads = list(nx.connected_components(G))
```

## Campaign Export to STIX

```python
import stix2

campaign = stix2.Campaign(
    name="SolarWinds Supply Chain",
    description="APT29 supply chain compromise via SolarWinds Orion",
    first_seen="2020-03-01T00:00:00Z",
    last_seen="2020-12-13T00:00:00Z",
)
```
