<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Conducting Threat Hunting Campaigns

## MITRE ATT&CK API

| Endpoint | Purpose |
|---|---|
| `GET /api/v2/techniques` | List all techniques |
| `GET /api/v2/techniques/{id}` | Get technique details |
| `GET /api/v2/datasources` | List data sources |
| `GET /api/v2/mitigations` | List mitigations per technique |

## Hunt Query Platforms

| Platform | Query Language | Key Commands |
|---|---|---|
| Splunk | SPL | `stats`, `eventstats`, `tstats`, `transaction` |
| Elastic | KQL / EQL | `stats`, `sequence`, `where` |
| Sentinel | KQL | `summarize`, `join`, `make-series` |
| CrowdStrike | FQL | `event_simpleName`, `ContextProcessId` |

## Campaign Status Codes

| Status | Description |
|---|---|
| `planned` | Hypothesis defined, not yet executed |
| `in_progress` | Actively running queries and analyzing |
| `completed` | Analysis finished, findings documented |
| `detection_created` | Findings converted to detection rules |

## Agent Script

```bash
# List available hunt hypotheses
node agent.js list

# Get specific hypothesis with query
node agent.js get c2_beaconing

# Create a hunt campaign
node agent.js campaign --name "Q1 LOLBin Hunt" --technique T1218 \
  --hypothesis "LOLBins used for execution bypass" \
  --data-sources sysmon_process_creation windows_security_4688 --timeframe 30
```
