<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Tuning EDR Detection Rules

## CrowdStrike Falcon API

| Endpoint | Description |
|---|---|
| `GET /detects/queries/detects/v1` | List detections |
| `POST /detects/entities/summaries/GET/v1` | Detection details |
| `PATCH /detects/entities/detects/v2` | Update detection status |
| `GET /policy/queries/ioa-exclusions/v1` | List IOA exclusions |
| `POST /policy/entities/ioa-exclusions/v1` | Create IOA exclusion |

## Microsoft Defender for Endpoint

| Endpoint | Description |
|---|---|
| `GET /api/alerts` | List alerts |
| `PATCH /api/alerts/{id}` | Update alert (classify FP) |
| `GET /api/indicators` | List custom indicators |
| `POST /api/indicators` | Create indicator (allow/block) |

## SentinelOne API

| Endpoint | Description |
|---|---|
| `GET /web/api/v2.1/threats` | List threats |
| `POST /web/api/v2.1/exclusions` | Create exclusion |
| `GET /web/api/v2.1/exclusions` | List exclusions |

## Agent Script

```bash
# Analyze alert volume
node agent.js analyze exported_alerts.json

# Generate exclusion record
node agent.js exclusion --rule "LSASS Access" --type process_path \
  --value "C:\Program Files\AV\scanner.exe" --scope "All Workstations" \
  --justification "AV scanner legitimate LSASS access"

# Coverage gap analysis
node agent.js gaps --covered T1059.001 T1003.001 T1053.005

# Generate tuning report
node agent.js report exported_alerts.json
```
