<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Security Orchestration Playbooks

## SOAR Platforms

| Platform | API Documentation |
|---|---|
| Splunk SOAR | `docs.splunk.com/Documentation/SOAR` |
| Cortex XSOAR | `xsoar.pan.dev/docs/reference` |
| Tines | `tines.com/docs` |
| Shuffle | `shuffler.io/docs` |

## Common Enrichment APIs

| API | Endpoint | Purpose |
|---|---|---|
| VirusTotal | `GET /api/v3/files/{hash}` | File hash reputation |
| AbuseIPDB | `GET /api/v2/check?ipAddress={ip}` | IP abuse score |
| URLScan.io | `POST /api/v1/scan` | URL analysis |
| Shodan | `GET /shodan/host/{ip}` | Host intelligence |

## Containment APIs

| Platform | Action | Method |
|---|---|---|
| CrowdStrike | Host isolation | `POST /devices/entities/devices-actions/v2` |
| Azure AD | Disable user | `PATCH /users/{id} {accountEnabled: false}` |
| PAN-OS | Block IP | `POST /api/?type=config&action=set` |

## Playbook Metrics

| Metric | Formula |
|---|---|
| MTTR | `avg(containment_time - alert_time)` |
| Auto-resolution rate | `auto_closed / total_alerts * 100` |
| False positive rate | `fp_alerts / total_alerts * 100` |
| SLA compliance | `within_sla / total_alerts * 100` |

## Agent Script

```bash
# Validate playbook definition
node agent.js validate playbooks/phishing.json

# Generate playbook skeleton
node agent.js generate --use-case phishing

# Calculate SOAR metrics
node agent.js metrics cases/2026-q1.json

# List available integrations
node agent.js list-integrations
```
