<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Threat Hunting Operations

## SIEM Hunt Query APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk | `POST /services/search/jobs` | Execute ad-hoc hunt query |
| Splunk | `GET /services/search/jobs/{sid}/results` | Retrieve hunt results |
| Elastic | `POST /{index}/_search` | Execute hunt query |
| Elastic | `POST /{index}/_async_search` | Long-running hunt query |
| Sentinel | `POST /query` | Execute KQL hunt query |

## ATT&CK Framework APIs

| Endpoint | Method | Purpose |
|---|---|---|
| `GET /api/v2/stix/attack-pattern` | GET | List ATT&CK techniques |
| `GET /api/v2/stix/attack-pattern/{id}` | GET | Get technique details |
| `GET /api/v2/stix/x-mitre-tactic` | GET | List tactics |

## Threat Intel for Hypothesis Generation

| Source | Endpoint | Purpose |
|---|---|---|
| MISP | `POST /events/restSearch` | Search for relevant campaigns |
| OTX | `GET /api/v1/pulses/subscribed` | Latest threat intel pulses |
| CISA KEV | `GET /known-exploited-vulnerabilities-catalog` | Active exploitation |

## Agent Script

```bash
# List ATT&CK techniques for hunting
node agent.js ttps

# Create a hunt plan
node agent.js create --hypothesis "APT using PowerShell for C2" --ttps T1059.001 T1071.001 --sources sysmon dns --days 14

# Suggest hunting techniques for data type
node agent.js suggest --data-type process
```
