Anthropic-Cybersecurity-Skills/skills/correlating-threat-campaigns/references/api-reference.md

Threat Campaign Correlation API Reference

MISP REST API

# Search attributes
curl -X POST "https://misp.example.com/attributes/restSearch" \
  -H "Authorization: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"type": "ip-src", "value": "185.220.101.42"}'

# Search events by tag
curl -X POST "https://misp.example.com/events/restSearch" \
  -H "Authorization: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"tags": ["apt28", "fancy-bear"], "from": "2024-01-01"}'

# Get event with correlations
curl "https://misp.example.com/events/view/1234" \
  -H "Authorization: YOUR_API_KEY" -H "Accept: application/json"

# Add attribute to event
curl -X POST "https://misp.example.com/attributes/add/1234" \
  -H "Authorization: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"type": "ip-dst", "value": "203.0.113.50", "category": "Network activity", "to_ids": true}'

MISP Correlation Engine

Correlation Type	Description
Attribute match	Same value in multiple events
CIDR overlap	IPs in same /24 or /16 subnet
Fuzzy hash (ssdeep)	Similar malware samples
Over-correlation	Common values excluded (CDN IPs)

OpenCTI GraphQL API

# Query campaign relationships
query {
  campaign(id: "campaign-uuid") {
    name
    first_seen
    last_seen
    objectsOfRelationship(relationship_type: "uses") {
      edges { node { ... on Malware { name } } }
    }
    objectsOfRelationship(relationship_type: "attributed-to") {
      edges { node { ... on IntrusionSet { name aliases } } }
    }
  }
}

STIX 2.1 Campaign Object

{
  "type": "campaign",
  "spec_version": "2.1",
  "id": "campaign--uuid",
  "name": "Operation ShadowStrike",
  "first_seen": "2024-01-15T00:00:00Z",
  "last_seen": "2024-06-30T00:00:00Z",
  "objective": "Data exfiltration from financial sector"
}

STIX Relationship Types

Type	Source	Target
attributed-to	Campaign	Threat Actor
uses	Intrusion Set	Malware / Tool
targets	Campaign	Identity / Sector
indicates	Indicator	Malware
related-to	Any	Any