<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Campaign Attribution

## MITRE ATT&CK Group Lookup

### attackcti Python Library
```python
from attackcti import attack_client
lift = attack_client()

# Get group profile
groups = lift.get_groups()
apt29 = [g for g in groups if "APT29" in g.get("name", "")]

# Get techniques used by group
techs = lift.get_techniques_used_by_group("G0016")

# Get software used by group
software = lift.get_software_used_by_group("G0016")

# Get groups using a technique
groups = lift.get_groups_using_technique("T1566.001")
```

### ATT&CK TAXII API
```bash
# Get group objects
curl -H "Accept: application/taxii+json;version=2.1" \
  "https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/objects/?match[type]=intrusion-set"
```

## ACH Matrix Template

```json
{
  "hypotheses": ["APT29", "APT28", "Lazarus", "Unknown"],
  "evidence": [
    {"id": "EV-001", "description": "SUNBURST malware variant", "category": "code_overlap"},
    {"id": "EV-002", "description": "C2 domain registered via Namecheap", "category": "infrastructure"},
    {"id": "EV-003", "description": "Government sector targeting", "category": "victimology"}
  ],
  "assessments": {
    "EV-001": {"APT29": "C", "APT28": "I", "Lazarus": "I", "Unknown": "N"},
    "EV-002": {"APT29": "C", "APT28": "C", "Lazarus": "N", "Unknown": "N"},
    "EV-003": {"APT29": "C", "APT28": "C", "Lazarus": "I", "Unknown": "N"}
  }
}
```

**Rating Key:** C = Consistent, I = Inconsistent, N = Neutral

## OpenCTI GraphQL — Attribution Queries

### Get Intrusion Set
```graphql
query {
  intrusionSets(search: "APT29") {
    edges {
      node {
        name
        aliases
        description
        first_seen
        last_seen
      }
    }
  }
}
```

### Get Related Campaigns
```graphql
query {
  campaigns(filters: { key: "objectLabel", values: ["apt29"] }) {
    edges {
      node {
        name
        first_seen
        last_seen
        description
      }
    }
  }
}
```

## Evidence Categories and Weights

| Category | Typical Weight | Notes |
|----------|---------------|-------|
| Code overlap | 0.9 | Shared unique code = strong signal |
| Infrastructure reuse | 0.8 | Same C2/registrant patterns |
| TTP consistency | 0.6 | ATT&CK overlap (common techniques dilute) |
| Victimology | 0.5 | Sector/geo targeting patterns |
| Operational timing | 0.4 | Business hours analysis |
| Language artifacts | 0.3 | Easily faked |
