<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Post-Incident Review — API Reference

## ATT&CK Navigator API

### Export Layer (Coverage Map)

```bash
# Download ATT&CK Navigator layer template
curl -sO "https://raw.githubusercontent.com/mitre-attack/attack-navigator/master/layers/data/samples/Bear_APT.json"

# Layer format for detection coverage
cat <<'EOF'
{
  "name": "INC-2026-0342 Detection Coverage",
  "versions": {"attack": "14", "navigator": "4.9"},
  "domain": "enterprise-attack",
  "techniques": [
    {"techniqueID": "T1059.001", "color": "#ff0000", "comment": "MISSED - No script block logging"},
    {"techniqueID": "T1003.006", "color": "#00ff00", "comment": "DETECTED - EDR behavioral rule"}
  ]
}
EOF
```

## Jira API — Create Improvement Actions

```bash
# Create action item ticket
curl -X POST "https://jira.company.com/rest/api/2/issue" \
  -H "Authorization: Bearer $JIRA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "fields": {
      "project": {"key": "SECOPS"},
      "summary": "PIR Action: Deploy Sysmon to 95% endpoints",
      "issuetype": {"name": "Task"},
      "priority": {"name": "Critical"},
      "labels": ["PIR", "INC-2026-0342"],
      "assignee": {"name": "it-ops-lead"},
      "duedate": "2026-04-15"
    }
  }'
```

## Metrics Calculations

### MTTD (Mean Time to Detect)

```
MTTD = Detection Timestamp - Initial Compromise Timestamp
Example: 2026-03-15T08:00Z - 2026-03-10T02:14Z = 5d 5h 46m
```

### MTTC (Mean Time to Contain)

```
MTTC = Containment Timestamp - Detection Timestamp
Example: 2026-03-15T10:30Z - 2026-03-15T08:00Z = 2h 30m
```

### MTTR (Mean Time to Recover)

```
MTTR = Recovery Timestamp - Detection Timestamp
Example: 2026-03-17T16:00Z - 2026-03-15T08:00Z = 2d 8h
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `detection_status` | Gap category | `no_telemetry`, `detected` |
| `technique_id` | MITRE ATT&CK ID | `T1059.001` |
| `priority` | Action priority | `P1` through `P4` |
| `coverage_percent` | Detection coverage ratio | `16.7%` |
| `dwell_time` | Compromise to detection | `5d 5h 46m` |
