<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# SIEM Rule Deployment — API Reference

## Sigma CLI

```bash
# Install
pip install sigma-cli pySigma-backend-splunk pySigma-backend-elasticsearch pySigma-pipeline-sysmon

# Convert to Splunk
sigma convert -t splunk -p splunk_cim rule.yml

# Convert to Elastic
sigma convert -t elasticsearch -p ecs_windows rule.yml

# Convert to Sentinel KQL
sigma convert -t microsoft365defender rule.yml

# List available backends
sigma list backends

# List available pipelines
sigma list pipelines

# Validate
sigma check rule.yml

# Convert with output
sigma convert -t splunk -p splunk_cim -o converted.spl rule.yml
```

## Splunk REST API

```bash
# List saved searches
curl -k -H "Authorization: Bearer $TOKEN" \
  https://splunk:8089/servicesNS/admin/search/saved/searches?output_mode=json

# Create saved search
curl -k -H "Authorization: Bearer $TOKEN" \
  -d "name=MyDetection&search=index%3Dendpoint%20...&is_scheduled=1&cron_schedule=*/5+*+*+*+*" \
  https://splunk:8089/servicesNS/admin/search/saved/searches

# Update saved search
curl -k -X POST -H "Authorization: Bearer $TOKEN" \
  -d "search=index%3Dendpoint%20...updated" \
  https://splunk:8089/servicesNS/admin/search/saved/searches/MyDetection

# Delete saved search
curl -k -X DELETE -H "Authorization: Bearer $TOKEN" \
  https://splunk:8089/servicesNS/admin/search/saved/searches/MyDetection

# Run ad-hoc search
curl -k -H "Authorization: Bearer $TOKEN" \
  -d "search=search index%3Dendpoint earliest%3D-1h" \
  https://splunk:8089/services/search/jobs
```

## Elastic Security API

```bash
# Create detection rule
curl -X POST "https://elastic:5601/api/detection_engine/rules" \
  -H "kbn-xsrf: true" -H "Authorization: ApiKey $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Detection",
    "description": "Detects suspicious activity",
    "type": "query",
    "query": "process.name: powershell.exe AND process.args: -enc*",
    "index": ["winlogbeat-*"],
    "severity": "high",
    "risk_score": 73,
    "interval": "5m",
    "from": "now-6m",
    "enabled": true,
    "tags": ["attack.execution", "attack.t1059.001"]
  }'

# List rules
curl "https://elastic:5601/api/detection_engine/rules/_find?per_page=100" \
  -H "kbn-xsrf: true" -H "Authorization: ApiKey $API_KEY"

# Delete rule
curl -X DELETE "https://elastic:5601/api/detection_engine/rules?id=RULE_ID" \
  -H "kbn-xsrf: true" -H "Authorization: ApiKey $API_KEY"
```

## Microsoft Sentinel API

```bash
# Create analytics rule (Azure REST API)
curl -X PUT "https://management.azure.com/subscriptions/$SUB/resourceGroups/$RG/providers/Microsoft.OperationalInsights/workspaces/$WS/providers/Microsoft.SecurityInsights/alertRules/$RULE_ID?api-version=2023-02-01" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "Scheduled",
    "properties": {
      "displayName": "My Detection",
      "query": "DeviceProcessEvents | where FileName == \"powershell.exe\"",
      "queryFrequency": "PT5M",
      "queryPeriod": "PT5M",
      "severity": "High",
      "triggerOperator": "GreaterThan",
      "triggerThreshold": 0,
      "enabled": true
    }
  }'
```

## Sigma Rule Severity to SIEM Mapping

| Sigma Level | Splunk Severity | Elastic Risk Score | Sentinel Severity |
|-------------|----------------|-------------------|-------------------|
| critical | 6 (Critical) | 99 | High |
| high | 5 (High) | 73 | High |
| medium | 3 (Medium) | 47 | Medium |
| low | 2 (Low) | 21 | Low |
| informational | 1 (Info) | 1 | Informational |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All rules deployed/converted successfully |
| 1 | Some rules failed |
| 2 | Configuration error or API failure |
