<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Threat Intelligence Workflows — API Reference

## VirusTotal API v3

```python
import requests

VT_KEY = "your-api-key"
VT_BASE = "https://www.virustotal.com/api/v3"
HEADERS = {"x-apikey": VT_KEY}

# IP lookup
resp = requests.get(f"{VT_BASE}/ip_addresses/1.2.3.4", headers=HEADERS)

# Domain lookup
resp = requests.get(f"{VT_BASE}/domains/evil.com", headers=HEADERS)

# File hash lookup
resp = requests.get(f"{VT_BASE}/files/{sha256_hash}", headers=HEADERS)

# URL scan
resp = requests.post(f"{VT_BASE}/urls", headers=HEADERS, data={"url": "https://evil.com"})
```

## MISP REST API

```python
MISP_URL = "https://misp.corp.local"
MISP_KEY = "your-misp-key"

# Search events by attribute
resp = requests.post(f"{MISP_URL}/events/restSearch", headers={
    "Authorization": MISP_KEY, "Content-Type": "application/json",
}, json={"value": "1.2.3.4", "type": "ip-dst"})

# Add attribute to event
requests.post(f"{MISP_URL}/attributes/add/{event_id}", headers={
    "Authorization": MISP_KEY,
}, json={"type": "ip-dst", "value": "1.2.3.4", "to_ids": True})
```

## AbuseIPDB API

```python
resp = requests.get("https://api.abuseipdb.com/api/v2/check", headers={
    "Key": "your-abuseipdb-key", "Accept": "application/json",
}, params={"ipAddress": "1.2.3.4", "maxAgeInDays": 90})
```

## OTX DirectConnect API

```python
resp = requests.get("https://otx.alienvault.com/api/v1/indicators/IPv4/1.2.3.4/general",
    headers={"X-OTX-API-KEY": "your-otx-key"})
```

## STIX 2.1 Indicator Format

```json
{
    "type": "indicator",
    "spec_version": "2.1",
    "id": "indicator--a1b2c3d4",
    "created": "2026-03-18T00:00:00Z",
    "pattern": "[ipv4-addr:value = '1.2.3.4']",
    "pattern_type": "stix",
    "valid_from": "2026-03-18T00:00:00Z",
    "labels": ["malicious-activity"]
}
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Workflow completed successfully |
| 1 | Partial enrichment — some sources failed |
| 2 | Feed ingestion failed |
