<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building SOC Metrics Dashboard

## Splunk Dashboard APIs

| Endpoint | Purpose |
|---|---|
| `POST /services/data/ui/views` | Create dashboard |
| `GET /services/data/ui/views/{name}` | Get dashboard XML |
| `POST /services/search/jobs` | Run search for metric |
| `GET /services/search/jobs/{sid}/results` | Get metric results |

## Grafana APIs

| Endpoint | Purpose |
|---|---|
| `POST /api/dashboards/db` | Create/update dashboard |
| `GET /api/datasources` | List data sources |
| `POST /api/alerts` | Create alert rule |
| `GET /api/search` | Search dashboards |

## SOC Metric Targets

| Metric | Target | Warning | Critical |
|---|---|---|---|
| MTTD | < 24h | 24-48h | > 48h |
| MTTR | < 4h | 4-12h | > 12h |
| MTTC | < 1h | 1-4h | > 4h |
| FPR | < 30% | 30-50% | > 50% |
| Escalation Rate | 10-20% | 20-40% | > 40% |
| Coverage | > 50% | 30-50% | < 30% |

## Visualization Types

| Metric | Chart Type |
|---|---|
| MTTD/MTTR trend | Line chart (time series) |
| Alert volume | Stacked bar chart |
| FP rate by rule | Horizontal bar chart |
| Coverage | ATT&CK Navigator heatmap |
| Analyst throughput | Table with sparklines |

## Agent Script

```bash
# List available metrics
node agent.js list

# Get metric definition with query
node agent.js get mttr

# Evaluate a metric against target
node agent.js evaluate --metric mttr --value 6.5
```
