<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing SIEM Correlation Rules

## Splunk ES APIs

| Endpoint | Purpose |
|---|---|
| `GET /services/saved/searches` | List correlation searches |
| `POST /services/saved/searches/{name}/dispatch` | Run search manually |
| `GET /services/search/jobs/{sid}/results` | Get search results |
| `GET /services/admin/macros` | List search macros |
| `GET /servicesNS/-/-/data/ui/views` | List dashboards |

## Elastic Security APIs

| Endpoint | Purpose |
|---|---|
| `GET /api/detection_engine/rules/_find` | List detection rules |
| `PUT /api/detection_engine/rules` | Update rule configuration |
| `GET /api/detection_engine/rules/prepackaged/_status` | Prebuilt rules status |

## Sentinel APIs

| Endpoint | Purpose |
|---|---|
| `GET /analyticsRules` | List analytics rules |
| `PUT /analyticsRules/{id}` | Update rule |
| `GET /incidents` | List incidents from rules |

## Rule Health Thresholds

| Metric | Healthy | Warning | Critical |
|---|---|---|---|
| FP Rate | < 20% | 20-40% | > 40% |
| Daily Fires | < 50 | 50-200 | > 200 |
| Runtime (sec) | < 120 | 120-300 | > 300 |
| Days Since Review | < 30 | 30-90 | > 90 |

## Agent Script

```bash
# List available health queries
node agent.js list

# Get specific query
node agent.js get fp_rate_splunk

# Analyze a rule's health
node agent.js analyze --rule-name "Brute Force Detection" \
  --total-fires 500 --fp-count 200 --avg-runtime 180.5
```
