<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Splunk Correlation Searches

## SPL Key Commands

| Command | Description |
|---|---|
| `stats count by field` | Aggregate events by field |
| `tstats` | Accelerated search over data models |
| `transaction` | Group events by shared field |
| `lookup` | Enrich with lookup table |
| `eval` | Compute new fields |
| `where` | Filter with expressions |
| `sendalert notable` | Create ES notable event |
| `collect` | Write results to index (RBA) |
| `datamodel` | Query CIM data models |

## Data Models (CIM)

| Model | Use Case |
|---|---|
| `Endpoint.Processes` | Process creation events |
| `Authentication` | Logon success/failure |
| `Network_Traffic` | Firewall and proxy logs |
| `Web` | HTTP request/response |
| `Change` | Configuration changes |

## Agent Script

```bash
# List correlation templates
node agent.js list

# Get specific template
node agent.js get brute_force

# Build custom search
node agent.js build --index windows --event-code 4625 --stats-by src_ip user --threshold 20

# Generate notable event action
node agent.js notable --name "Brute Force Detected" --severity high --domain access
```
